cash.org.hk XSS vulnerability

Vulnerable URL: http://www.cash.org.hk/en/index.php?main=3=24%22%3E%3Cscript%3Ealert%28%27XSSPOSED%27%29%3C%2Fscript%3E⊂=35 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2328723...

RHEL 5 / 6 / 7 : thunderbird (RHSA-2015:1852)

An updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

siemens-home.com XSS vulnerability

Vulnerable URL: http://www.siemens-home.com/ae/no-search-results?search=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28%2FXSSPOSED%2F%29%3E Details: Description| Value ---|--- Patched:| Yes, at 14.12.2016 Latest check for patch:| 14.12.2016 10:44 GMT Vulnerability type:| XSS Vulnerability status:|...

hartmann.info XSS vulnerability

Vulnerable URL: http://hartmann.info/en/pages/search-page?query=%22%3E%3Cscript%3Ealert%28%27XSSPOSED%27%29%3B%3C%2Fscript%3E=0 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 24881...

Design/Logic Flaw

packages/Keyguard/res/layout/keyguardpasswordview.xml in Lockscreen in Android 5.x before 5.1.1 LMY48M does not restrict the number of characters in the passwordEntry input field, which allows physically proximate attackers to bypass intended access restrictions via a long password that triggers ...

CVE-2015-3860

packages/Keyguard/res/layout/keyguardpasswordview.xml in Lockscreen in Android 5.x before 5.1.1 LMY48M does not restrict the number of characters in the passwordEntry input field, which allows physically proximate attackers to bypass intended access restrictions via a long password that triggers ...

RHEL 5 / 6 / 7 : openldap (RHSA-2015:1840)

Updated openldap packages that fix one security issue are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Gentoo Security Advisory GLSA 201412-53

Gentoo Linux Local Security Checks GLSA 201412-53 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Gentoo Security Advisory GLSA 201312-12

Gentoo Linux Local Security Checks GLSA 201312-12 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

jobintree.com XSS vulnerability

Vulnerable URL: http://www.jobintree.com/mailing/unsubscribe.php?email=%27%22%3E%3E%3C/title%3E%27%22%3ESCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28/XSSPOSED/%29%3C/SCRIPT%3E=EPR-25-newsletter0185informatique-20110105-desinscription-1@1-20110105160000 Details: Description| Value ---|--- Patched:| No...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in EMC RSA Archer GRC 5.x before 5.5.3 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

unitedvanlines.com XSS vulnerability

Vulnerable URL: http://www.unitedvanlines.com/search-results?search=" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 239415 Google Pagerank| 5 VIP website status:| No Check...

CVE-2015-4541

EMC RSA Archer GRC 5.x suffers multiple stored XSS vulnerabilities in versions prior to 5.5.3. The issues allow remote authenticated users to inject arbitrary script/HTML in the user’s browser, via unspecified vectors, potentially impacting session security. RSA ESA-2015-142 confirms fixed in 5.5...

CVE-2015-4543

RSA Archer GRC Platform 5.x prior to 5.5.3 stores passwords in cleartext in the database under certain circumstances, enabling authenticated read access to expose credentials. Affected product: RSA Archer GRC (5.x). Root cause: plaintext password storage in unspecified conditions. Impact: potenti...

[SECURITY] Fedora 23 Update: icu-54.1-5.fc23

Tools and utilities for developing with icu...

Authentication flaw

Mozilla Firefox before 41.0 allows remote attackers to bypass certain ECMAScript 5 aka ES5 API protection mechanisms and modify immutable properties, and consequently execute arbitrary JavaScript code with chrome privileges, via a crafted web page that does not use ES5 APIs...

CVE-2015-4516

CVE-2015-4516 affects Mozilla Firefox before 41.0. A crafted page can bypass ECMAScript 5 protections and modify immutable properties, allowing remote code to run with chrome privileges via JavaScript. The issue is fixed in Firefox 41.0 (and ESR tracks) per releases and security advisories; users...

KLA11454 Multiple vulnerabilities in SeaMonkey

Multiple vulnerabilities were found in SeaMonkey. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, bypass security restrictions and spoof user interface. Below is a complete list of vulnerabilities: 1. Multiple memory corruption vulnerabilities...

JavaScript immutable property enforcement can be bypassed — Mozilla

Mozilla developer Jeff Walden reported that in Gecko's implementation of ECMAScript 5 API's enforces non-configurable properties with logic specific to each API. Scripts that do not go through these APIs can bypass these protections and make changes to the immutable properties in violation of...

CVE-2015-4516

Mozilla Firefox before 41.0 allows remote attackers to bypass certain ECMAScript 5 aka ES5 API protection mechanisms and modify immutable properties, and consequently execute arbitrary JavaScript code with chrome privileges, via a crafted web page that does not use ES5 APIs...