PT-2014-4342

Name of the Vulnerable Software and Affected Versions ForzeArmate application for Android versions with Adobe PhoneGap 2.9.0 or earlier Description The issue allows remote attackers to execute arbitrary JavaScript code and obtain write access to external-storage resources by leveraging control ov...

PT-2014-4344

Name of the Vulnerable Software and Affected Versions DrinkedIn BarFinder application for Android versions with Adobe PhoneGap 2.9.0 or earlier Description The issue allows remote attackers to execute arbitrary JavaScript code and obtain sensitive fine-geolocation information by leveraging contro...

PT-2014-4343

Name of the Vulnerable Software and Affected Versions Edinburgh by Bus application for Android versions using Adobe PhoneGap 2.9.0 or earlier Description The issue allows remote attackers to execute arbitrary JavaScript code and access external-storage resources by leveraging control over certain...

CVE-2014-1887: Undefined Security Weakness

The DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain sensitive fine-geolocation information, by leveraging control over one of a number of adult sites, as demonstrated b...

PT-2014-1992

Name of the Vulnerable Software and Affected Versions Apache Cordova In-App-Browser standalone plugin versions prior to 0.3.2 In-App-Browser plugin for iOS from Cordova versions 2.6.0 through 2.9.0 Description The issue is related to the CDVInAppBrowser class, which does not properly validate...

Cisco MARS Cross Site Scripting

Vulnerability Type: Cross-Site Scripting CVE: CVE-2013-5563 Products and affected versions: Cisco Security Monitoring, Analysis and Response System CS-MARS - All versions Vendor Website: http://www.cisco.com/en/US/products/ps6241/ Cisco Advisory: https://tools.cisco.com/bugsearch/bug/CSCul16173...

CVE-2013-5598: Undefined Security Weakness

PDF.js in Mozilla Firefox before 25.0 and Firefox ESR 24.x before 24.1 does not properly handle the appending of an IFRAME element, which allows remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges by using this element within an embedded PDF object...

PT-2013-5668

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 25.0 Mozilla Firefox ESR versions 24.x prior to 24.1 Description The issue allows remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges by using an IFRAME element...

CVE-2013-5703

The DrayTek Vigor 2700 router 2.8.3 allows remote attackers to execute arbitrary JavaScript code, and modify settings or the DNS cache, via a crafted SSID value that is not properly handled during insertion into the sWlessSurvey value in variables.js...

Code injection

The DrayTek Vigor 2700 router 2.8.3 allows remote attackers to execute arbitrary JavaScript code, and modify settings or the DNS cache, via a crafted SSID value that is not properly handled during insertion into the sWlessSurvey value in variables.js...

PT-2013-5738

Name of the Vulnerable Software and Affected Versions DrayTek Vigor 2700 router version 2.8.3 Description The issue allows remote attackers to execute arbitrary JavaScript code and modify settings or the DNS cache. This is achieved by using a crafted SSID value that is not properly handled during...

CVE-2013-5703: Improper Neutralization of Special Elements used in an OS Command

The DrayTek Vigor 2700 router 2.8.3 allows remote attackers to execute arbitrary JavaScript code, and modify settings or the DNS cache, via a crafted SSID value that is not properly handled during insertion into the sWlessSurvey value in variables.js...

PT-2013-5485

Name of the Vulnerable Software and Affected Versions Adobe Reader and Acrobat versions 11.0.0 through 11.0.04 Description The issue allows remote attackers to execute arbitrary JavaScript code in a javascript: URL via a crafted PDF document. Recommendations For Adobe Reader and Acrobat versions...

CVE-2013-5325: Improper Control of Generation of Code

Adobe Reader and Acrobat 11.x before 11.0.05 on Windows allow remote attackers to execute arbitrary JavaScript code in a javascript: URL via a crafted PDF document...

PT-2013-70

Name of the Vulnerable Software and Affected Versions Serv-U File Server affected versions not specified Description The issue is related to insufficient validation of client-supplied parameters used in HTM scripts, allowing a remote attacker to execute arbitrary JavaScript code in the user's...

Nodejs js-yaml load() Code Execution Vulnerability

For node.js applications that parse user-supplied YAML input using the load function from the 'js-yaml' package versions below 2.0.5, specifying a self-executing function allows us to execute arbitrary javascript code. This Metasploit module demonstrates that behavior. This file is part of the...

Cross site scripting

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows remote attackers to execute arbitrary JavaScript code or conduct cross-site scripting XSS attacks...

CVE-2013-1710

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows remote attackers to execute arbitrary JavaScript code or conduct cross-site scripting XSS attacks...

PT-2013-3342

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 23.0 Firefox ESR 17.x versions prior to 17.0.8 Thunderbird versions prior to 17.0.8 Thunderbird ESR 17.x versions prior to 17.0.8 SeaMonkey versions prior to 2.20 Description The issue allows remote attackers ...

Nodejs js-yaml load() Code Execution

This module can be used to abuse node.js applications that parse user-supplied YAML input using the load function from the 'js-yaml' package use exploit/multi/fileformat/nodejs/jsyamlloadcodeexec msf undefinedjsyamlloadcodeexec show actions ...actions... msf undefinedjsyamlloadcodeexec set ACTION...