firefox security update

60.2.0-1.0.1 - fix LDLIBRARYPATH - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one 60.2.0-1 - Update to 60.2.0 ESR 60.1.0-9 - Do not set user agent rhbz1608065 - GTK dialogs are localized now rhbz1619373 - JNLP association works again rhbz1607457 60.1.0-8 - Fixed...

CVE-2018-17254

The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter...

CVE-2018-17254

The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter...

September 20, 2018—KB4457127 (OS Build 14393.2515)

None None...

firefox security update

60.2.0-1.0.1 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 60.2.0-1 - Update to 60.2.0 ESR 60.1.0-9 - Do not set user agent rhbz1608065 - GTK dialogs are localized now rhbz1619373 - JNLP association works again rhbz1607457 60.1.0-8 - Fixed homepage and bookmarks...

chromium-browser: URL spoof in permission dialogs

A race condition between permission prompts and navigations in Prompts in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

Cross-site Scripting (XSS)

pimcore/pimcore is vulnereable to cross-site scripting XSS attacks. The library does not sanitize the text fields in multiple pop-up dialogs, allowing a malicious user to inject and execute arbitrary Javascript...

CVE-2017-7815

On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Javascript that will have an arbitrary domains as the dialog's location, spoofing of the origin of the modal dialog from the user view. Note: This attack only affects installations with e10 multiproce...

CVE-2017-7815

On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Javascript that will have an arbitrary domains as the dialog's location, spoofing of the origin of the modal dialog from the user view. Note: This attack only affects installations with e10 multiproce...

May 17, 2018—KB4103722 (OS Build 15063.1112)

None None...

Jenkins Multiple Vulnerabilities (Apr 2018) - Windows

Jenkins is prone to multiple vulnerabilities. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

FreeBSD : jenkins -- multiple vulnerabilities (aaba17aa-782e-4843-8a79-7756cfa2bf89)

Jenkins developers report : The Jenkins CLI sent different error responses for commands with view and agent arguments depending on the existence of the specified views or agents to unauthorized users. This allowed attackers to determine whether views or agents with specified names exist. The...

Brave Browser Denial of Service Vulnerability (CNVD-2018-08687 )

Brave Browser is a web browser from Brave Software, USA. A security vulnerability exists in Brave Browser versions prior to 0.13.0, which arises from the program's failure to properly handle window dialogs. A remote attacker can exploit this vulnerability to cause a denial of service resource...

CVE-2017-18256

Brave Browser before 0.13.0 allows remote attackers to cause a denial of service resource consumption via a long alert argument in JavaScript code, because window dialogs are mishandled...

CVE-2017-18256

Brave Browser before 0.13.0 allows remote attackers to cause a denial of service resource consumption via a long alert argument in JavaScript code, because window dialogs are mishandled...

EUVD-2017-9387

Brave Browser before 0.13.0 allows remote attackers to cause a denial of service resource consumption via a long alert argument in JavaScript code, because window dialogs are mishandled...

CVE-2017-18256

Brave Browser before 0.13.0 is vulnerable to a Denial of Service via a long alert() argument in JavaScript, caused by mishandling of window dialogs. A remote attacker can trigger resource consumption leading to a crash or degraded performance. Public references show PoC-style input and do not det...

CVE-2017-18256

Brave Browser before 0.13.0 allows remote attackers to cause a denial of service resource consumption via a long alert argument in JavaScript code, because window dialogs are mishandled...

Design/Logic Flaw

Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing in permission dialogs via IDN homographs in a crafted Chrome Extension...

CVE-2017-15394

Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing in permission dialogs via IDN homographs in a crafted Chrome Extension...