CVE-2012-4379

MediaWiki versions affected: prior to 1.18.5 and 1.19.x prior to 1.19.2. The issue is that the application does not send a restrictive X-Frame-Options header, enabling clickjacking via an embedded API response in an IFRAME. The provided documents describe the vulnerability without detailing explo...

CVE-2017-3823

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Firefox, the GpcContainer Class ActiveX control plugin before 10031.6.2017.0126 on Internet Explorer, and the Download Manager ActiveX control plugin...

CVE-2017-3823

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Firefox, the GpcContainer Class ActiveX control plugin before 10031.6.2017.0126 on Internet Explorer, and the Download Manager ActiveX control plugin...

Cross-site Scripting (XSS)

Chargify2 is vulnerable to cross-site scripting XSS. It does not sanitize the API response from Chargify2, allowing XSS attacks...

Shopify: Shopify android client all API request's response leakage, including access_token, cookie, response header, response body content

Shopify android client all API request's response leakage, including accesstoken, cookie, response header, response body content and much other information. An attacker can extract cookie and accesstoken of Shopify android client without any permission needed and user awareness. Bug impact: A...

CVE-2012-6582

Cross-site scripting XSS vulnerability in the Spambot module 6.x-3.x before 6.x-3.2 and 7.x-1.x before 7.x-1.1 for Drupal allows certain remote attackers to inject arbitrary web script or HTML via a stopforumspam.com API response, which is logged by the watchdog...