CVE-2014-8025

The API in the Guest Server in Cisco Jabber, when HTML5 is used, allows remote attackers to obtain sensitive information by sniffing the network during an HTTP 1 GET or 2 POST response, aka Bug ID CSCus19801...

CVE-2014-8024

The API in the Guest Server in Cisco Jabber, when the HTML5 CORS feature is used, allows remote attackers to obtain sensitive information by sniffing the network during an HTTP 1 GET or 2 POST request, aka Bug ID CSCus19789...

CVE-2014-8025

The Cisco advisory (Cisco Jabber Guest Server HTML5) describes a vulnerability in the Guest Server where missing encryption on sensitive data sent via HTTP GET/POST can be sniffed by an unauthenticated remote attacker to disclose information. Exploitation requires access to the network segment wh...

PT-2014-8389

Name of the Vulnerable Software and Affected Versions Cisco Jabber affected versions not specified Description The issue allows remote attackers to obtain sensitive information by sniffing the network during an HTTP request, specifically when the HTML5 CORS feature is used in the Guest Server. Th...

PT-2014-8390

Name of the Vulnerable Software and Affected Versions Cisco Jabber affected versions not specified Description The issue allows remote attackers to obtain sensitive information by sniffing the network during an HTTP response, specifically when using HTML5 in the Guest Server API. This can occur...

CVE-2014-8024: Exposure of Sensitive Information to an Unauthorized Actor

The API in the Guest Server in Cisco Jabber, when the HTML5 CORS feature is used, allows remote attackers to obtain sensitive information by sniffing the network during an HTTP 1 GET or 2 POST request, aka Bug ID CSCus19789...

CVE-2014-1592

Use-after-free vulnerability in the nsHtml5TreeOperation function in xul.dll in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code by adding a second root element to an HTML5 document duri...

CVE-2014-1592

Use-after-free vulnerability in the nsHtml5TreeOperation function in xul.dll in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code by adding a second root element to an HTML5 document duri...

FreeBSD : mozilla -- multiple vulnerabilities (7ae61870-9dd2-4884-a2f2-f19bb5784d09)

The Mozilla Project reports : ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory MFSA-2014-89 Bad casting from the BasicThebesLayer to BasicContainerLayer...

Mozilla: Use-after-free during HTML5 parsing (MFSA 2014-87)

Use-after-free vulnerability in the nsHtml5TreeOperation function in xul.dll in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code by adding a second root element to an HTML5 document duri...

Mozilla: Use-after-free during HTML5 parsing (MFSA 2014-87)

Use-after-free vulnerability in the nsHtml5TreeOperation function in xul.dll in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code by adding a second root element to an HTML5 document duri...

CVE-2014-9177

The HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers to obtain the installation path via a request to html5plus/playlist.php...

Path traversal

The HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers to obtain the installation path via a request to html5plus/playlist.php...

CVE-2014-9177

The HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers to obtain the installation path via a request to html5plus/playlist.php...

CVE-2014-9177

The CVE-2014-9177 entry concerns the WordPress plugin “HTML5 MP3 Player with Playlist Free” (before version 2.7). The vulnerability is a path-disclosure flaw where an attacker can obtain the WordPress installation path via a request to html5plus/playlist.php. Impact is limited to information disc...

Use-after-free during HTML5 parsing — Mozilla

Security researcher SkyLined reported a use-after-free created by triggering the creation of a second root element while parsing HTML written to a document created with document.open. This leads to a potentially exploitable crash...

CVE-2014-1592

Use-after-free vulnerability in the nsHtml5TreeOperation function in xul.dll in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code by adding a second root element to an HTML5 document duri...

CVE-2014-9177: Exposure of Sensitive Information to an Unauthorized Actor

The HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers to obtain the installation path via a request to html5plus/playlist.php...

PT-2014-8868

Name of the Vulnerable Software and Affected Versions HTML5 MP3 Player with Playlist Free plugin versions prior to 2.7 Description The issue allows remote attackers to obtain the installation path via a request to "html5plus/playlist.php". Recommendations For versions prior to 2.7, update to...

WordPress HTML5 MP3 Player with Playlist Free Plugin <= 2.6 - Full Path Disclosure

Because of this vulnerability, the attackers can obtain the installation path via a request to html5plus/playlist.php. Solution Upgrade the plugin...