CVE-2015-8480

The CVE-2015-8480 entry relates to Google Chrome before 47.0.2526.73. The vulnerability arises because VideoFramePool::PoolImpl::CreateFrame does not initialize memory for a video-frame data structure, enabling remote attackers to trigger a denial of service via out-of-bounds memory access, poten...

chromium-browser: Various fixes from internal audits

The VideoFramePool::PoolImpl::CreateFrame function in media/base/videoframepool.cc in Google Chrome before 47.0.2526.73 does not initialize memory for a video-frame data structure, which might allow remote attackers to cause a denial of service out-of-bounds memory access or possibly have...

Imgur: Attack User Privacy Settings - X-Frame-Options missing on m.imgur.com/user/username/settings

Hello, I would like to report that almost entire mobile web site is vulnerable to clickjacking attacks, Maybe the most important critical part the /settings node, As an attacker could force a user to change his privacy settings with only two clicks, please see live video demonstration, of course...

Frame high-speed chat vulnerable to cross-site scripting

Overview Frame high-speed chat provided by Let's PHP! contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Apply an Update Update to the latest version according to the information provided by the developer...

Hsecscan - A Security Scanner For HTTP Response Headers

hsecscan A security scanner for HTTP response headers. Requirements Python 2.x Usage $ ./hsecscan.py usage: hsecscan.py -h -P -p -u URL -R -U User-Agent -d 'POST data' -x PROXY A security scanner for HTTP response headers. optional arguments: -h, --help show this help message and exit -P,...

The vulnerability of the microprogramming software for Micrologix 1100 and 1400 allows a intruder to inject content from an arbitrary file into the FRAME element.

The vulnerability of the microprogrammed logic controllers Micrologix 1100 and 1400 lies in the lack of restrictions on the download of files. Exploiting this vulnerability allows a malicious actor to inject any file content into the FRAME element remotely...

CVE-2015-4112

CVE-2015-4112 affects the BlackBerry Enterprise Server (BES) Management Console. The issue arises because the console does not properly restrict the use of FRAME elements, enabling remote attackers to perform clickjacking via a crafted website (cross-frame scripting). Affects BES 12 before 12.2; ...

Debian DSA-3397-1 : wpa - security update

Several vulnerabilities have been discovered in wpasupplicant and hostapd. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2015-4141 Kostya Kortchinsky of the Google Security Team discovered a vulnerability in the WPS UPnP function with HTTP chunked...

UBUNTU-CVE-2015-5310

The WNM Sleep Mode code in wpasupplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection MFP was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service ignored packets via a...

CVE-2006-7178

MadWifi before 0.9.3 does not properly handle reception of an AUTH frame by an IBSS node, which allows remote attackers to cause a denial of service system crash via a certain AUTH frame...

Allen-Bradley MicroLogix Arbitrary File Insertion Vulnerability

Allen-Bradley MicroLogix is a programmable logic controller PLC from Rockwell Automation. An arbitrary file insertion vulnerability exists in Allen-Bradley MicroLogix 1100 before B FRN 15.000 and 1400 before B FRN 15.003. It allows an authenticated remote user to insert the contents of an arbitra...

The vulnerability of Google Chrome browser allows a violator to circumvent existing access restrictions.

The vulnerability of the Blink component in Google Chrome exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass existing access restrictions by using a specially crafted HTML document containing an IFRAME element...

CVE-2015-7836

Siemens RUGGEDCOM ROS before 4.2.1 allows remote attackers to obtain sensitive information by sniffing the network for VLAN data within the padding section of an Ethernet frame...

CVE-2015-6491

Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote authenticated users to insert the content of an arbitrary file into a FRAME element via unspecified vectors...

Design/Logic Flaw

Siemens RUGGEDCOM ROS before 4.2.1 allows remote attackers to obtain sensitive information by sniffing the network for VLAN data within the padding section of an Ethernet frame...

Code injection

Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote authenticated users to insert the content of an arbitrary file into a FRAME element via unspecified vectors...

CVE-2015-6491

Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote authenticated users to insert the content of an arbitrary file into a FRAME element via unspecified vectors...

CVE-2015-7836

Siemens RUGGEDCOM ROS before 4.2.1 allows remote attackers to obtain sensitive information by sniffing the network for VLAN data within the padding section of an Ethernet frame...

CVE-2015-5178

The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a 1 FRAME or 2...

Design/Logic Flaw

The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a 1 FRAME or 2...