PT-2014-2021

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 55 Description The issue is related to a security policy inheritance error. It may allow a remote attacker to bypass security restrictions. Specifically, when an "iframe" has a "sandbox" attribute and its...

Content Security Policy Mitigates XSS, Breaks Sites

Content Security Policy CSP is an effective, browser-based deterrent against cross-site scripting attacks. Despite this, the vast majority of websites do not deploy the standard, and the majority of those that do, deploy it improperly. The goal of CSP is to mitigate content injection attacks...

NX5Linkx 1.0 Links.PHP HTTP Response Splitting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/20011/info NX5Linkx is prone to an HTTP response-splitting vulnerability because the application fails to properly sanitize user-supplied input. A remote attacker may exploit this vulnerability to influence or misrepresen...

Internet Bug Bounty: Cross-site information assertion leak via Content Security Policy

It is possible to test for the satisfaction of certain assertions across origins by abuse of Content Security Policy. These could be assertions such as 'is the client logged into this website', or 'is the client logged in as this user', or 'does the client have access to these panels'. This gener...

openSUSE Security Update : seamonkey (openSUSE-SU-2011:0957-1)

Mozilla SeaMonkey suite was updated to version 2.3. The update fixes bugs and security issues. Following security issues were fixed: http://www.mozilla.org/security/announce/2011/mfsa2011-33.html Mozilla Foundation Security Advisory 2011-33 MFSA 2011-33 Mozilla Foundation Security Advisory 2011-3...

openSUSE Security Update : MozillaFirefox (openSUSE-SU-2011:0957-2)

Mozilla Firefox was updated to version 6. It brings new features, fixes bugs and security issues. Following security issues were fixed: http://www.mozilla.org/security/announce/2011/mfsa2011-29.html Mozilla Foundation Security Advisory 2011-29 MFSA 2011-29 dbg114-MozillaFirefox-5020...

openSUSE Security Update : seamonkey (openSUSE-SU-2011:0957-1)

Mozilla SeaMonkey suite was updated to version 2.3. The update fixes bugs and security issues. Following security issues were fixed: http://www.mozilla.org/security/announce/2011/mfsa2011-33.html Mozilla Foundation Security Advisory 2011-33 MFSA 2011-33 Mozilla Foundation Security Advisory 2011-3...

CVE-2014-3289

Cross-site scripting XSS vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance ESA 8.0, Web Security Appliance WSA 8.0 .5 Hot Patch 1 and earlier, and Content Security Management Appliance SMA 8.3 and earlier allows remote attackers to inject arbitrary web...

Cross site scripting

Cross-site scripting XSS vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance ESA 8.0, Web Security Appliance WSA 8.0 .5 Hot Patch 1 and earlier, and Content Security Management Appliance SMA 8.3 and earlier allows remote attackers to inject arbitrary web...

CVE-2014-3289

CVE-2014-3289 is a reflected XSS vulnerability in Cisco AsyncOS used by ESA, WSA, and SMA. The issue stems from insufficient input validation of the date_range parameter on the web management interface (notably monitor/reports/overview). A remote attacker can inject arbitrary script by tricking a...

PT-2014-5184

Name of the Vulnerable Software and Affected Versions Cisco AsyncOS on the Email Security Appliance ESA versions 8.0 and earlier Cisco AsyncOS on the Web Security Appliance WSA versions 8.0.5 Hot Patch 1 and earlier Cisco AsyncOS on the Content Security Management Appliance SMA versions 8.3 and...

CVE-2014-3289: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance ESA 8.0, Web Security Appliance WSA 8.0 .5 Hot Patch 1 and earlier, and Content Security Management Appliance SMA 8.3 and earlier allows remote attackers to inject arbitrary web...

Cisco AsyncOS contains a reflected cross-site scripting (XSS) vulnerability

Overview Cisco AsyncOS contains a reflected cross-site scripting XSS vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - CVE-2014-3289 Cisco AsyncOS, the underlying OS for the Cisco Email Security Appliance, Web Security Applianc...

Arbitrary Code Execution

Overview Affected versions of this package are vulnerable to Arbitrary Code Execution. $parse allowed arbitrary code execution via Angular expressions under some very specific conditions. The only applications affected by these vulnerabilities are those that match all of the following conditions:...

X (Formerly Twitter): XSS vulnerability in video player page

Hello, I found a XSS vulnerability in your site. Try this:...

Server: Multiple XSS

Due to not sanitising all user provided input the below mentioned ownCloud versions are vulnerable against several XSS attack vectors. ownCloud advises browsers to disable inline JavaScript execution due to the used Content-Security-Policy, this vulnerability is therefore likely not exploitable i...

Design/Logic Flaw

Cisco AsyncOS on Email Security Appliance ESA and Content Security Management Appliance SMA devices, when Active Directory is enabled, does not properly handle group names, which allows remote attackers to gain role privileges by leveraging group-name similarity, aka Bug ID CSCum86085...

CVE-2014-2195

CVE-2014-2195 affects Cisco AsyncOS on Email Security Appliance (ESA) and Content Security Management Appliance (SMA). When Active Directory is enabled, the software does not properly handle group names, enabling a remote attacker to gain role privileges by exploiting group-name similarity (Bug I...

CVE-2014-2195

Cisco AsyncOS on Email Security Appliance ESA and Content Security Management Appliance SMA devices, when Active Directory is enabled, does not properly handle group names, which allows remote attackers to gain role privileges by leveraging group-name similarity, aka Bug ID CSCum86085...

PT-2014-4549

Name of the Vulnerable Software and Affected Versions Cisco AsyncOS on Email Security Appliance ESA and Content Security Management Appliance SMA devices affected versions not specified Description The issue is related to the handling of group names when Active Directory is enabled. It allows...