CVE-2016-1667

Removed by vendor...

chromium-browser: same origin bypass in dom

The TreeScope::adoptIfNeeded function in WebKit/Source/core/dom/TreeScope.cpp in the DOM implementation in Blink, as used in Google Chrome before 50.0.2661.102, does not prevent script execution during node-adoption operations, which allows remote attackers to bypass the Same Origin Policy via a...

Google Chrome < 50.0.2661.102 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 50.0.2661.102. It is, therefore, affected by multiple vulnerabilities as referenced in the 201605stable-channel-update advisory. - The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome...

CVE-2016-1667

The TreeScope::adoptIfNeeded function in WebKit/Source/core/dom/TreeScope.cpp in the DOM implementation in Blink, as used in Google Chrome before 50.0.2661.102, does not prevent script execution during node-adoption operations, which allows remote attackers to bypass the Same Origin Policy via a...

5 Vulnerabilities Fixed In Chrome Browser, Google Pays $20K to Bug Hunters

Google is urging Windows, Mac and Linux users to update their Chrome browser to fix five security holes – two which rate as high severity. Google warned users of the vulnerabilities Wednesday as it released a new version, 50.0.2661.102, of the browser. The Chrome security holes were found by four...

CVE-2016-1667

The TreeScope::adoptIfNeeded function in WebKit/Source/core/dom/TreeScope.cpp in the DOM implementation in Blink, as used in Google Chrome before 50.0.2661.102, does not prevent script execution during node-adoption operations, which allows remote attackers to bypass the Same Origin Policy via a...

chromium: multiple issues

CVE-2016-1667: Same origin bypass in DOM. Credit to Mariusz Mlynski. - CVE-2016-1668: Same origin bypass in Blink V8 bindings. Credit to Mariusz Mlynski. - CVE-2016-1669: Buffer overflow in V8. Credit to Choongwoo Han. - CVE-2016-1670: Race condition in loader. Credit to anonymous...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 5 security fixes in this release, including: 605766 High CVE-2016-1667: Same origin bypass in DOM. Credit to Mariusz Mlynski. 605910 High CVE-2016-1668: Same origin bypass in Blink V8 bindings. Credit to Mariusz Mlynski. 606115 High CVE-2016-1669: Buffer overflow i...

Cross-Site Scripting

Overview Affected versions of backbone are vulnerable to cross-site scripting when users are allowed to supply input to the ModelEscape function, and the output is then written to the DOM. The vulnerability occurs as a result of the regular expression used to encode metacharacters failing to take...

Swagger Editor 2.9.9 Cross Site Scripting

Swagger Editor v2.9.9 "description" Key DOM-based Cross-Site Scripting RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Swagger Editor Vendor URL: https://github.com/swagger-api/swagger-editor Type: Cross-Site Scripting CWE-79 Date found:...

Htcap - web application scanner able to crawl single page application (SPA) in a recursive manner by intercepting ajax calls and DOM changes

htcap is a web application scanner able to crawl single page application SPA in a recursive manner by intercepting ajax calls and DOM changes. Htcap is not just another vulnerability scanner since it's focused mainly on the crawling process and uses external tools to discover vulnerabilities. It'...

Adobe Analytics AppMeasurement for Flash Library Patch

Adobe today patched a vulnerability in the Adobe Analytics AppMeasurement for Flash library, which can be added to Flash projects to measure the usage of Flash-based content. The vulnerability is a DOM-based cross-site scripting flaw that can be abused for cookie theft, said researcher Randy...

APSB16-13 Security update available for the Adobe Analytics AppMeasurement for Flash Library

Adobe has released a security update for the Adobe Analytics AppMeasurement for Flash library. This update resolves an important vulnerability in the AppMeasurement for Flash library that could be abused to conduct DOM-based cross-site scripting attacks when debugTracking is enabled...

[SECURITY] Fedora 24 Update: xerces-c-3.1.3-1.fc24

Xerces-C is a validating XML parser written in a portable subset of C++. Xerces-C makes it easy to give your application the ability to read and write XML data. A shared library is provided for parsing, generating, manipulating, and validating XML documents. Xerces-C is faithful to the XML 1.0...

WordPress iThemes Security Plugin <= 5.3.4 - DOM XSS

This plugin is prone to potential authenticated DOM cross site scripting vulnerability. Solution Update the plugin...

iThemes Security <= 5.3.4 - Potential Authenticated DOM Cross-Site Scripting (XSS)

The iThemes Security formerly Better WP Security WordPress plugin was affected by a Potential Authenticated DOM Cross-Site Scripting XSS security vulnerability...

LocalTapiola: www.lahitapiola.fi DOM XSS by choosing regional company

please check screenshot first. browser: Chromelatest or Internet Explorer 11 steps to reproduce: - go to page http://www.lahitapiola.fi/henkilo" - press Valitse alueyhtiösi button - input zip e.g. 111 vulnerable js code - https://www.lahitapiola.fi/cs/lahitapiola/js/scripts.js...

WordPress Twenty Fifteen Theme-DOM型跨站脚本漏洞

No description provided by source...

[SECURITY] Fedora 24 Update: seamonkey-2.40-1.fc24

SeaMonkey is an all-in-one Internet application suite. It includes a browser, mail/news client, IRC client, JavaScript debugger, and a tool to inspect the DOM for web pages. It is derived from the application formerly known as Mozilla Application Suite...

[SECURITY] Fedora 22 Update: seamonkey-2.40-1.fc22

SeaMonkey is an all-in-one Internet application suite. It includes a browser, mail/news client, IRC client, JavaScript debugger, and a tool to inspect the DOM for web pages. It is derived from the application formerly known as Mozilla Application Suite...