CVE-2016-5191

Bookmark handling in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation of supplied data, which allowed a remote attacker to inject arbitrary scripts or HTML UXSS via crafted HTML pages, as demonstrated by an interpretation confli...

U.S. Dept Of Defense: HTML injection vulnerability on a DoD website

An HTML injection vulnerability was found on a Department of Defense website which may have been used to trick a web user into viewing modified web content, potentially revealing a user's web session information, or other sensitive information. @kunalkhubchandani was able to demonstrate this...

KLA10914 Multiple vulnerabilities in Google Chrome

Multiple serious vulnerabilities have been found in Google Chrome prior to 54.0.2840.59. Malicious users can exploit these vulnerabilities to bypass security restrictions, spoof user interface, inject code or possibly cause denial of service. Below is a complete list of vulnerabilities: 1. Missed...

Mozilla Firefox < 50.1 Multiple Vulnerabilities (macOS)

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 50.1. It is, therefore, affected by the following vulnerabilities : - Multiple memory corruption issues exists when handling style contexts, regular expressions, and clamped gradients that allow an...

Mozilla Firefox ESR 45.x < 45.6 Multiple Vulnerabilities (macOS)

The version of Mozilla Firefox ESR installed on the remote macOS or Mac OS X host is 45.x prior to 45.6. It is, therefore, affected by the following vulnerabilities : - Multiple memory corruption issues exist, such as when handling document state changes or HTML5 content, or else due to...

CVE-2016-9901

HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" unprivileged page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR 45.6 and Firefox...

[ASA-201612-15] firefox: multiple issues

Arch Linux Security Advisory ASA-201612-15 ========================================== Severity: Critical Date : 2016-12-14 CVE-ID : CVE-2016-9080 CVE-2016-9893 CVE-2016-9894 CVE-2016-9895 CVE-2016-9896 CVE-2016-9897 CVE-2016-9898 CVE-2016-9899 CVE-2016-9900 CVE-2016-9901 CVE-2016-9902 CVE-2016-99...

UBUNTU-CVE-2016-9901

HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" unprivileged page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR 45.6 and Firefox...

Security vulnerabilities fixed in Firefox 50.1 — Mozilla

A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation. Later writers will overflow the buffer, resulting in a potentially exploitable crash. Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption. Event...

KLA10913 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, obtain sensitive information, execute arbitrary code, possibly cause denial of service, gain priveleges or make code injections. Below is a...

CVE-2016-9903

Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resource to be loaded as a document it could allow injecting content and script into an add-on's context. This vulnerability affects Firefox 50.1...

CVE-2016-9901

HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" unprivileged page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR 45.6 and Firefox...

UBUNTU-CVE-2016-9903

Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resource to be loaded as a document it could allow injecting content and script into an add-on's context. This vulnerability affects Firefox 50.1...

Security vulnerabilities fixed in Firefox ESR 45.6 — Mozilla

Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption. Event handlers on marquee elements were executed despite a strict Content Security Policy CSP that disallowed inline JavaScript. Memory corruption resulting in a potentially...

Firefox SVG Cross-Domain Cookie Injection Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A cross-domain cookie injection vulnerability exists in the Firefox SVG element, which can be exploited by an attacker to inject arbitrary web script or HTML code...

WordPress Image Gallery Plugin HTML Injection Vulnerability

WordPress is the WordPress Software Foundation of a set of PHP language development of the blog platform , the platform supports PHP and MySQL server set up a personal blog site . Image Gallery is one of the image processing plug-ins . WordPress Image Gallery version 1.9.65 there is an HTML...

CVE-2016-2955

Cross-site scripting XSS vulnerability in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the UI in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allow remote authenticated users to inject arbitrary web script or HTML via crafted fields in a URL...

Red Hat JBoss BRMS and BPM Suite Incompletely Fix HTML Injection Vulnerability

Red Hat JBoss BRMS and BPM Suite are both products of Red Hat Red Hat. The former is a set of enterprise-class business rules management system platform, the latter is a set of JBoss BRMS all the functions of the collection of business process management platform. An HTML injection vulnerability...

CVE-2016-5955

Cross-site scripting XSS vulnerability in IBM Rational DOORS Next Generation 6.0.2 before iFix004 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...