Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary JavaScript by uploading a zip file through the assignment submission function. This results in text and HTML being rendered during a download all action...

Microsoft Internet Explorer Elevation of Privilege Vulnerability (CVE-2017-0154)

Original link: a Broken Browser Original author: Manuel Caballero Translation: Holic know Chong Yu 404 security lab Today we know from Internet Explorer since the birth there has been function. This feature allows the Web Developer instance of the external object, and therefore be the attacker to...

January 26, 2017—KB 3216755 (OS Build 14393.726)

None None...

PT-2016-7902

Name of the Vulnerable Software and Affected Versions Mozilla Thunderbird versions prior to 45.4.0 Description The issue affects Mozilla Thunderbird when used in a browser-like context for rendering HTML emails or feeds, making it susceptible to vulnerabilities also present in Firefox ESR 45.4. T...

[SECURITY] Fedora 23 Update: kf5-kdewebkit-5.24.0-1.fc23

KDE Frameworks 5 Tier 3 integration module for the HTML rendering engine We bKit...

[SECURITY] Fedora 24 Update: kf5-kdewebkit-5.24.0-1.fc24

KDE Frameworks 5 Tier 3 integration module for the HTML rendering engine We bKit...

Microsoft Internet Explorer Cmarkup Memory Misreference Vulnerability

Microsoft Internet Explorer IE is a Web browser developed by the American company Microsoft and is the default browser that comes with the Windows operating system. A memory misreference vulnerability exists in Microsoft Internet Explorer Cmarkup, due to a failure to properly handle CMarkup in...

PT-2014-2543

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 1.4.x through 1.4.22 Apache Wicket versions 1.5.x through 1.5.10 Apache Wicket versions 6.x through 6.7.x Description The issue allows remote attackers to obtain sensitive information via vectors that cause raw HTML...

Metasploit Exploit Module for IE Zero-Day Vulnerability

It’s been 14 days since Microsoft issued an advisory and temporary mitigation for a zero-day vulnerability in Internet Explorer, one being actively exploited in the wild and called by some experts as severe a browser bug as you can have. Yet users have since had little more to shield them from...

Internet Explorer HTML Rendering Engine onLoseCapture Use-After-Free Vulnerability

Added: 09/25/2013 CVE: CVE-2013-3893 BID: 62453 OSVDB: 97380 Background Internet Explorer is an HTML web browser which comes by default on Microsoft operating systems. Problem Microsoft Internet Explorer 6 through 11 contain a use-after-free vulnerability in the SetMouseCapture implementation in...

Internet Explorer HTML Rendering Engine onLoseCapture Use-After-Free Vulnerability

Added: 09/25/2013 CVE: CVE-2013-3893 BID: 62453 OSVDB: 97380 Background Internet Explorer is an HTML web browser which comes by default on Microsoft operating systems. Problem Microsoft Internet Explorer 6 through 11 contain a use-after-free vulnerability in the SetMouseCapture implementation in...

Internet Explorer HTML Rendering Engine onLoseCapture Use-After-Free Vulnerability

Added: 09/25/2013 CVE: CVE-2013-3893 BID: 62453 OSVDB: 97380 Background Internet Explorer is an HTML web browser which comes by default on Microsoft operating systems. Problem Microsoft Internet Explorer 6 through 11 contain a use-after-free vulnerability in the SetMouseCapture implementation in...

Microsoft Warns of New IE Zero Day

UPDATE–Microsoft is looking into reports of targeted attacks against a new vulnerability that exists in all supported versions of Internet Explorer. The attacks are targeting IE 8 and 9 and there’s no patch for the vulnerability right now, though Microsoft has developed a FixIt tool for it. “The...

Scientific Linux Security Update : elinks on SL4.x, SL5.x i386/x86_64

CVE-2007-2027 elinks tries to load .po files from a non-absolute path CVE-2008-7224 elinks: entitycache static array buffer overflow off-by-one An off-by-one buffer overflow flaw was discovered in the way ELinks handled its internal cache of string representations for HTML special entities. A...

CVE-2012-2364

Cross-site scripting XSS vulnerability in lib/filelib.php in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via an assignment submission with zip compression, leading to text/html rendering during a...

Flock 2.6.1 Denial Of Service

Exploit Title: Flock 2.6.1 DoS Date: 29/03/2012 Author: r45c4l Email: [email protected] Product url: http://flock.en.softonic.com/ Version: 2.6.1 CVE : :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: Produ...

CVE-2011-1940

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 3.3.x before 3.3.10.1 and 3.4.x before 3.4.1 allow remote attackers to inject arbitrary web script or HTML via a crafted table name that triggers improper HTML rendering on a Tracking page, related to 1 libraries/tbllinks.inc.php and...

CVE-2011-1940

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 3.3.x before 3.3.10.1 and 3.4.x before 3.4.1 allow remote attackers to inject arbitrary web script or HTML via a crafted table name that triggers improper HTML rendering on a Tracking page, related to 1 libraries/tbllinks.inc.php and...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 3.3.x before 3.3.10.1 and 3.4.x before 3.4.1 allow remote attackers to inject arbitrary web script or HTML via a crafted table name that triggers improper HTML rendering on a Tracking page, related to 1 libraries/tbllinks.inc.php and...

CVE-2011-1940

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 3.3.x before 3.3.10.1 and 3.4.x before 3.4.1 allow remote attackers to inject arbitrary web script or HTML via a crafted table name that triggers improper HTML rendering on a Tracking page, related to 1 libraries/tbllinks.inc.php and...