CVE-2015-0818

Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving SVG hash navigation...

PT-2015-4887

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 36.0.4 Firefox ESR versions prior to 31.5.3 SeaMonkey versions prior to 2.33.1 Description The issue allows remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome...

CVE-2015-1483: Improper Input Validation

Symantec NetBackup OpsCenter 7.6.0.2 through 7.6.1 on Linux and UNIX allows remote attackers to execute arbitrary JavaScript code via unspecified vectors...

Symantec NetBackup OpsCenter Arbitrary Code Execution Vulnerability

Symantec NetBackup OpsCenter is a unified data protection management software from Symantec Symantec. The software allows centralized monitoring and reporting of the operational status of heterogeneous data protection environments through a console. A security vulnerability exists in Symantec...

PT-2015-5319

Name of the Vulnerable Software and Affected Versions Symantec NetBackup OpsCenter versions 7.6.0.2 through 7.6.1 Description The issue allows remote attackers to execute arbitrary JavaScript code. Recommendations For Symantec NetBackup OpsCenter versions 7.6.0.2 through 7.6.1, at the moment, the...

CVE-2015-0821: Undefined Security Weakness

Mozilla Firefox before 36.0 allows user-assisted remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges via a crafted web site that is accessed with unspecified mouse and keyboard actions...

PT-2015-4890

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 36.0 Description The issue allows user-assisted remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges via a crafted web site that is accessed with unspecified mou...

Cross-Site Scripting (XSS)

CKEditor is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the user...

WordPress Geo Mashup 1.8.2 Cross Site Scripting

Vulnerability title: Wordpress Geo Mashup plugin XSS Author: Paolo Perego CVE: CVE-2015-1383 Affected versions: = 1.8.2 Fixed version: 1.8.3 January, 11 2015 Product link: https://wordpress.org/plugins/geo-mashup/ Description Geo Mashup is a wordpress plugin designed to let you save location...

Design/Logic Flaw

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with a DOM object that has a named getter, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via unspecified vectors...

CVE-2014-8636

The XrayWrapper implementation in Mozilla Firefox (before 35.0) and SeaMonkey (before 2.32) contains a vulnerability where it fails to properly interact with DOM objects possessing a named getter. This flaw allows remote attackers to bypass security restrictions and execute arbitrary JavaScript c...

CVE-2014-8636

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with a DOM object that has a named getter, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via unspecified vectors...

CVE-2014-8636: Improper Control of Generation of Code

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with a DOM object that has a named getter, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via unspecified vectors...

PT-2015-4067

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 35.0 SeaMonkey versions prior to 2.32 Description The issue is related to the XrayWrapper implementation, which does not properly interact with a DOM object that has a named getter. This might allow remote...

Ubuntu 12.04 LTS : kde-runtime vulnerability (USN-2414-1)

Tim Brown and Darron Burton discovered that KDE-Runtime incorrectly handled input validation. An attacker could possibly use this issue to execute arbitrary javascript. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory...

USN-2414-1: KDE-Runtime vulnerability

Tim Brown and Darron Burton discovered that KDE-Runtime incorrectly handled input validation. An attacker could possibly use this issue to execute arbitrary javascript...

[RT-SA-2013-003] Endeca Latitude Cross-Site Scripting

Advisory: Endeca Latitude Cross-Site Scripting RedTeam Pentesting discovered a Cross-Site Scripting XSS vulnerability in Endeca Latitude. By exploiting this vulnerability an attacker is able to execute arbitrary JavaScript code in the context of other Endeca Latitude users. Details ======= Produc...

CVE-2014-7205

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors...

CVE-2014-7205: Improper Control of Generation of Code

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors...

Arachni Web Application Scanner Web UI - Persistent Cross-Site Scripting

Arachni Web Application Scanner Web UI - Persistent Cross-Site Scripting Title: Arachni Web Application Scanner Web UI Stored XSS Vulnerability CVE: 2014-5469 Vendor Homepage: http://www.arachni-scanner.com/ Author: Prakhar Prasad Author Homepage: https://prakharprasad.com Reference:...