Nodejs js-yaml load() Code Execution

This module can be used to abuse node.js applications that parse user-supplied YAML input using the load function from the 'js-yaml' package use exploit/multi/fileformat/nodejs/jsyamlloadcodeexec msf undefinedjsyamlloadcodeexec show actions ...actions... msf undefinedjsyamlloadcodeexec set ACTION...

CVE-2013-1688

The Profiler implementation in Mozilla Firefox before 22.0 parses untrusted data during UI rendering, which allows user-assisted remote attackers to execute arbitrary JavaScript code via a crafted web site...

PT-2013-3323

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 22.0 Description The issue allows user-assisted remote attackers to execute arbitrary JavaScript code via a crafted web site, due to the Profiler implementation parsing untrusted data during UI rendering...

CVE-2013-1688: Improper Control of Generation of Code

The Profiler implementation in Mozilla Firefox before 22.0 parses untrusted data during UI rendering, which allows user-assisted remote attackers to execute arbitrary JavaScript code via a crafted web site...

CVE-2013-1697: Undefined Security Weakness

The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with...

CVE-2013-1687: Undefined Security Weakness

The System Only Wrapper SOW and Chrome Object Wrapper COW implementations in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly restrict XBL user-defined functions, which allows remote attackers to execute...

PT-2013-3330

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 22.0 Firefox ESR 17.x versions prior to 17.0.7 Thunderbird versions prior to 17.0.7 Thunderbird ESR 17.x versions prior to 17.0.7 Description The issue allows remote attackers to execute arbitrary JavaScript...

CVE-2013-1697

The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with...

CVE-2013-1687

The System Only Wrapper SOW and Chrome Object Wrapper COW implementations in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly restrict XBL user-defined functions, which allows remote attackers to execute...

CVE-2013-1688

The Profiler implementation in Mozilla Firefox before 22.0 parses untrusted data during UI rendering, which allows user-assisted remote attackers to execute arbitrary JavaScript code via a crafted web site...

PT-2013-3322

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 22.0 Firefox ESR 17.x versions prior to 17.0.7 Thunderbird versions prior to 17.0.7 Thunderbird ESR 17.x versions prior to 17.0.7 Description The issue allows remote attackers to execute arbitrary JavaScript...

PT-2013-4540

Name of the Vulnerable Software and Affected Versions Cybozu Live application versions prior to 2.0.1 Description The issue in the Cybozu Live application allows attackers to execute arbitrary JavaScript code and obtain sensitive information. This is achieved by a crafted application placing...

CVE-2013-3647: Exposure of Sensitive Information to an Unauthorized Actor

The WebView class in the Cybozu Live application before 2.0.1 for Android allows attackers to execute arbitrary JavaScript code, and obtain sensitive information, via a crafted application that places this code into a local file associated with a file: URL. NOTE: this vulnerability exists because...

XSS Vulnerability in MediaElement.js - ownCloud

A cross-site scripting XSS vulnerability in all ownCloud versions prior to 5.0.5 including the 4.5.x branch allows remote attackers to execute arbitrary javascript when a user opens a special crafted URL. This vulnerability exists in the bundled 3rdparty plugin "MediaElement.js", "MediaElement.js...

PT-2013-2622

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 20.0 Firefox ESR 17.x versions prior to 17.0.5 Thunderbird versions prior to 17.0.5 Thunderbird ESR 17.x versions prior to 17.0.5 SeaMonkey versions prior to 2.17 Description The issue allows remote attackers ...

WS-2020-0019

Versions of @hapi/boom prior t 0.3.8 are vulnerable to Cross-Site Scripting XSS. The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser...

Ruby on Rails Patches DoS, XSS Vulnerabilities

The developers of Ruby on Rails, the popular web app framework, released four new versions of the product yesterday, complete with fixes for a series of vulnerabilities that could have lead to denial of service attacks and XSS injections. Four vulnerabilities in total are addressed in versions...

WordPress Occasions 1.0.4 Cross Site Request Forgery

CSRF Occasions input type="hidden" name="occtype1" value="1"...

WordPress Plugin Simply Poll 1.4.1 - Multiple Vulnerabilities

WordPress Plugin Simply Poll 1.4.1 - Multiple Vulnerabilities Exploit Title: WordPress Simply Poll Plugin 1.4.1 CSRF and stored XSS Google Dork: inurl:"/wp-content/plugins/simply-poll Date: 16.03.2013 Exploit Author: m3tamantra Vendor Homepage: http://wordpress.org/extend/plugins/simply-poll/...

WordPress Plugin Simply Poll 1.4.1 - Multiple Vulnerabilities

Exploit Title: WordPress Simply Poll Plugin 1.4.1 CSRF and stored XSS Google Dork: inurl:"/wp-content/plugins/simply-poll Date: 16.03.2013 Exploit Author: m3tamantra Vendor Homepage: http://wordpress.org/extend/plugins/simply-poll/ Software Link:...