Liferay Portal User Account Stored Cross Site Scripting (CVE-2016-3670)

A persistent XSS vulnerability exists in the user account creation process in Liferay Portal. The vulnerability is due to insufficient input validation of the firstName, middleName and lastName parameters. Successful exploitation could allow the attacker to inject arbitrary script code into a use...

CVE-2016-3670

The CVE-2016-3670 entry describes a stored XSS in Liferay through the Profile Search feature. According to the provided materials, the vulnerability arises when a malicious payload is placed in the FirstName field during user creation, which can be exploited via the Profile Search function (User ...

Liferay CE < 6.2 CE GA6 - Persistent Cross-Site Scripting

Exploit for php platform in category web applications CVE-2016-3670 Stored Cross Site Scripting in Liferay CE 1. Vulnerability Properties Title: Stored Cross-Site Scripting Liferay CE CVE ID: CVE-2016-3670 CVSSv3 Base Score: 4.6 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N Vendor: Liferay Inc Products:...

Liferay CE < 6.2 CE GA6 - Persistent Cross-Site Scripting

CVE-2016-3670 Stored Cross Site Scripting in Liferay CE 1. Vulnerability Properties Title: Stored Cross-Site Scripting Liferay CE CVE ID: CVE-2016-3670 CVSSv3 Base Score: 4.6 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N Vendor: Liferay Inc Products: Liferay Advisory Release Date: 27 May 2016 Advisory URL:...

Liferay CE 6.2 CE GA6 - Persistent Cross-Site Scripting

Liferay CE 6.2 CE GA6 - Persistent Cross-Site Scripting CVE-2016-3670 Stored Cross Site Scripting in Liferay CE 1. Vulnerability Properties Title: Stored Cross-Site Scripting Liferay CE CVE ID: CVE-2016-3670 CVSSv3 Base Score: 4.6 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N Vendor: Liferay Inc Products:...

Liferay CE Stored Cross Site Scripting

Fernando Câmara @ Integrity S.A www.integrity.pt https://twitter.com/overflowy https://labs.integrity.pt/advisories/cve-2016-3670/ --- CVE-2016-3670 Stored Cross Site Scripting in Liferay CE 1. Vulnerability Properties Title: Stored Cross-Site Scripting Liferay CE CVE ID: CVE-2016-3670 CVSSv3 Bas...

CVE-2007-4038

Argument injection vulnerability in Mozilla Firefox before 2.0.0.5, when running on systems with Thunderbird 1.5 installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto URI, which...

Oracle: Security Advisory (ELSA-2014-1824)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle: Security Advisory (ELSA-2014-1768)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle: Security Advisory (ELSA-2012-0080)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gentoo Security Advisory GLSA 201411-04

Gentoo Linux Local Security Checks GLSA 201411-04 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Amazon Linux: Security Advisory (ALAS-2014-434)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Important: Red Hat Security Advisory: php security update

Updated php packages that fix two security issues are now available for Red Hat Enterprise Linux 6.5 Extended Update Support. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

PHP exif Extension exif_ifd_make_value Thumbnail Heap Buffer Overflow (CVE-2014-3670)

A code execution vulnerability exists in PHP exif extension. The vulnerability is due to a buffer overflow when handles exif thumbnail. A remote attacker can exploit the vulnerability by sending crafted picture data to a web application running a vulnerable version of PHP...

SOL15866 - Multiple PHP vulnerabilities CVE-2014-3668, CVE-2014-3669, and CVE-2014-3670

Recommended Action None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5 critical issue...

[SECURITY] [DLA 94-1] php5 security update

Package : php5 Version : 5.3.3-7+squeeze23 CVE ID : CVE-2014-3668 CVE-2014-3669 CVE-2014-3670 CVE-2014-3710 CVE-2014-3668 Fix bug 68027 - fix date parsing in XMLRPC lib CVE-2014-3669 Fix bug 68044: Integer overflow in unserialize 32-bits only CVE-2014-3670 Fix bug 68113 Heap corruption in...

SuSE 11.3 Security Update : php53 (SAT Patch Number 9916)

This update fixes the following vulnerabilities in php : - Heap corruption issue in exifthumbnail. CVE-2014-3670 - Integer overflow in unserialize. CVE-2014-3669 - Xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime. CVE-2014-3668 %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

openSUSE Security Update : php5 (openSUSE-SU-2014:1391-1)

security update : - CVE-2014-3670 bnc902357 - CVE-2014-3669 bnc902360 - CVE-2014-3668 bnc902368 - added patches : - php-CVE-2014-3670.patch - php-CVE-2014-3669.patch - php-CVE-2014-3668.patch %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

openSUSE Security Update : php5 (openSUSE-SU-2014:1377-1)

security update : - CVE-2014-3670 bnc902357 - CVE-2014-3669 bnc902360 - CVE-2014-3668 bnc902368 - added patches : - php-CVE-2014-3670.patch - php-CVE-2014-3669.patch - php-CVE-2014-3668.patch %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

GLSA-201411-04 : PHP: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201411-04 PHP: Multiple vulnerabilities Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact : A context-dependent attacker can possibly execute arbitrary cod...