ASP.NET Core HTTP Header Injection Vulnerability

ASP.NET Core is a new open source and cross-platform framework for building modern cloud-based applications connected to the Internet such as web applications, Internet of Things IoT applications, and mobile back-end applications. An HTTP header injection vulnerability exists in ASP.NET Core...

CVE-2016-9681

Multiple cross-site scripting XSS vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a category or directory name...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a category or directory name...

Hardcoded credentials

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign = or a space into the injected HTML, which greatly reduces the available HTML functionality...

DEBIAN-CVE-2016-7966

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign = or a space into the injected HTML, which greatly reduces the available HTML functionality...

CVE-2016-7966

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign = or a space into the injected HTML, which greatly reduces the available HTML functionality...

CVE-2016-7966

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign = or a space into the injected HTML, which greatly reduces the available HTML functionality...

CVE-2016-7966

CVE-2016-7966 affects KDE’s KMail plaintext viewer. A crafted URL containing a quote character can inject HTML code due to the URL parser’s handling, limiting inclusion of characters like = or space, but allowing an HTML comment indicator to hide content. This creates a potential HTML injection r...

CVE-2016-7966

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign = or a space into the injected HTML, which greatly reduces the available HTML functionality...

Horde Groupware and Horde Groupware Webmail Cross-Site Scripting Vulnerabilities

Horde Groupware and Horde Groupware Webmail Edition are both products of Horde Corporation, USA.Horde Groupware is a free browser based on the Collaboration Suite.Horde Groupware Webmail is a free enterprise browser based on the Communication Suite. Horde Text Filter API is one of the methods for...

VMware ESXi HTML Injection Vulnerability

VMware ESXi is a bare-metal virtualization hypervisor from VMware that is installed directly on a physical server and divides the physical server into multiple virtual machines. The program features less disk space, higher reliability and security. An HTML injection vulnerability exists in VMware...

CVE-2016-4552

Cross-site scripting XSS vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the href attribute in an area tag in an e-mail message...

CVE-2016-4552

Cross-site scripting XSS vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the href attribute in an area tag in an e-mail message...

CVE-2016-5191

Bookmark handling in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation of supplied data, which allowed a remote attacker to inject arbitrary scripts or HTML UXSS via crafted HTML pages, as demonstrated by an interpretation confli...

U.S. Dept Of Defense: HTML injection vulnerability on a DoD website

An HTML injection vulnerability was found on a Department of Defense website which may have been used to trick a web user into viewing modified web content, potentially revealing a user's web session information, or other sensitive information. @kunalkhubchandani was able to demonstrate this...

KLA10914 Multiple vulnerabilities in Google Chrome

Multiple serious vulnerabilities have been found in Google Chrome prior to 54.0.2840.59. Malicious users can exploit these vulnerabilities to bypass security restrictions, spoof user interface, inject code or possibly cause denial of service. Below is a complete list of vulnerabilities: 1. Missed...

Mozilla Firefox < 50.1 Multiple Vulnerabilities (macOS)

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 50.1. It is, therefore, affected by the following vulnerabilities : - Multiple memory corruption issues exists when handling style contexts, regular expressions, and clamped gradients that allow an...

Mozilla Firefox ESR 45.x < 45.6 Multiple Vulnerabilities (macOS)

The version of Mozilla Firefox ESR installed on the remote macOS or Mac OS X host is 45.x prior to 45.6. It is, therefore, affected by the following vulnerabilities : - Multiple memory corruption issues exist, such as when handling document state changes or HTML5 content, or else due to...

CVE-2016-9901

HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" unprivileged page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR 45.6 and Firefox...

[ASA-201612-15] firefox: multiple issues

Arch Linux Security Advisory ASA-201612-15 ========================================== Severity: Critical Date : 2016-12-14 CVE-ID : CVE-2016-9080 CVE-2016-9893 CVE-2016-9894 CVE-2016-9895 CVE-2016-9896 CVE-2016-9897 CVE-2016-9898 CVE-2016-9899 CVE-2016-9900 CVE-2016-9901 CVE-2016-9902 CVE-2016-99...