Ubuntu 18.04 LTS : WebKitGTK+ regression (USN-3781-2)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3781-2 advisory. USN-3781-1 fixed vulnerabilities in WebKitGTK+. The updated package was missing some header files, preventing certain applications from building. This update fixe...

Ubuntu 18.04 LTS : WebKitGTK+ vulnerabilities (USN-3781-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3781-1 advisory. A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, ...

Microsoft Edge - Sandbox Escape

Microsoft Edge - Sandbox Escape 1. Content process - Privileged content process firststage.js When spawning a new Edge content process, its privilege is determined by its URL. This URL check is performed by the LCIEUrlPolicy::GetPICForPrivilegedInternalPage method in eModel.dll. The method calls...

firefox security update

CentOS Errata and Security Advisory CESA-2018:2692 An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Microsoft Office SharePoint CVE-2018-8426 Cross Site Scripting Vulnerability

Description Microsoft Office SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...

Microsoft Edge CVE-2018-8425 Spoofing Vulnerability

Description Microsoft Edge is prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies Affected Microsoft Edge...

Microsoft Internet Explorer CVE-2018-8470 Security Bypass Vulnerability

Description Microsoft Internet Explorer is prone to a security-bypass vulnerability. Successfully exploiting this issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions. This may lead to other attacks. Internet Explorer 11 is vulnerable. Technologies...

CVE-2018-1000665

CVE-2018-1000665 affects the Dojo Dojo Objective Harness (DOH) prior to version 1.14. The vulnerability is an XSS in unit.html and related tests (testsDOH/_base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/_base/i18nExhaustive.js) that can cause a victim’s browser to execute injected s...

Bucking the Norm, Mozilla to Block Tracking Cookies in Firefox

Web tracking has long been in the cross-hairs of privacy advocates, who say that marketers know entirely too much about individuals’ online activities. And to add insult to injury, the ubiquitous cookie system used to enable tracking also presents potential security threats, including cross-site...

DNC: Highly Publicized ‘Phishing Attempt’ Was Only a Security Test

A day after the Democratic National Committee riled up security researchers and the press, it’s walking back an assertion that there was an attempt to compromise its voter database. Though it seemed like the event was the latest in a series of malicious efforts designed to harvest credentials...

gwjuniortour.bluegolf.com XSS vulnerability

Open Bug Bounty ID: OBB-664212 Description| Value ---|--- Affected Website:| gwjuniortour.bluegolf.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Microsoft Edge CVE-2018-8388 Spoofing Vulnerability

Description Microsoft Edge is prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies Affected Microsoft Edge...

Apache Axis CVE-2018-8032 Cross-Site Scripting Vulnerability

Description Apache Axis is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the...

CVE-2017-1544

IBM Sterling B2B Integrator Standard Edition (IBM Sterling File Gateway 2.2.0–2.2.6) is affected by CVE-2017-1544. The issue allows local attackers to obtain sensitive information because usernames and passwords are cached in browsers. The root cause is information disclosure via cached credentia...

pazar24.com XSS vulnerability

Open Bug Bounty ID: OBB-648602 Description| Value ---|--- Affected Website:| pazar24.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

We block shady ad blockers

Some of you have reached out to us concerning Malwarebytes blocking of certain ad blocking extensions, or an influx in web blocking notifications. First things first, this is not a false positive. Recently in their blog, AdGuard has discovered that numerous malicious ad blocking extensions were...

Neatly bypassing CSP

How to trick CSP in letting you run whatever you want By bo0om, Wallarm research Content Security Policy or CSP is a built-in browser technology which helps protect from attacks such as cross-site scripting XSS. It lists and describes paths and sources, from which the browser can safely load...

Microsoft Edge CVE-2018-8278 Spoofing Vulnerability

Description Microsoft Edge is prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies Affected Microsoft Edge...

thermosphere.tudelft.nl XSS vulnerability

Open Bug Bounty ID: OBB-641938 Description| Value ---|--- Affected Website:| thermosphere.tudelft.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Security Bulletin: IBM Smart Analytics System 5600 is affected by multiple vulnerabilities in the IBM SDK Java™ Technology Edition, Version 6

Summary The IBM Smart Analytics System 5600 contains a management host that is installed with the Mozilla Firefox browser. The browser is configured to use IBM SDK Java™ Technology Edition, Version 6 for Java Web Start applications. The browser software is configured in this manner to allow the u...