407 matches found
CVE-2015-6942
Cross-site scripting XSS vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in a document attachment...
CVE-2015-6942
Cross-site scripting XSS vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in a document attachment...
shop.hyperlink.ba XSS vulnerability
Vulnerable URL: http://shop.hyperlink.ba/product.php?item=19101%22%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 03.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated...
Stored XSS in "gemirro" via injection in Gemspec "homepage" value
Stored cross-site scripting XSS vulnerability in Gemirro allows attackers to inject arbitrary web script via a crafted JavaScript URL in the "homepage" value of a ".gemspec" file. A ".gemspec" file must be created with a JavaScript URL in the homepage value. This can be used to build a gem for...
RSA Login Links Do Not Show as Hyperlinks in E-mail in Secure Mail
Secure mail app is unable to open hyperlinks from RSA site. The app is capable of opening other URL links but not this hyperlink. com.rsa.securid://ctf?ctfData=12345...... It shows up as regular text instead of a hyperlink...
Security vulnerabilities fixed in Thunderbird 52.1 — Mozilla
A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the animation controller while still in use. This results in a potentially exploitable crash. A use-after-free vulnerability occurs during transaction processing in t...
Unpatched SMB Zero Day Easily Exploitable
In what’s turning out to be the zero day that keeps on giving, researchers are still finding ways to exploit an unpatched denial of service vulnerability that exists in the way Windows implements the Server Message Block protocol. Details around the bug aren’t a mystery. Laurent Gaffié, the...
RoundCube Webmail Cross-Site Scripting Vulnerability (CNVD-2016-13003)
RoundCube Webmail is a browser-based IMAP client mail client that supports address book management, message searching, spell checking and more. A cross-site scripting vulnerability exists in versions of Roundcube Webmail prior to 1.2.0. A remote attacker can exploit this vulnerability to inject...
Pushwoosh: Spoof Email with Hyperlink Injection via Invites functionality
Email Spoofing via hyperlink injection. Design Issue, Missing Best Practice, Low severity...
Apache OpenMeetings Event Description Cross-Site Scripting (CVE-2016-2163)
A cross-site scripting vulnerability has been reported in the event handling component of Apache OpenMeetings. The vulnerability is due to insufficient validation of input for event descriptions. A remote, authenticated attacker could exploit this vulnerability by scheduling an event with a craft...
New Relic: Hyperlink Injection on adding active users
@japz discovered an issue with how some email clients render text. This issue was determined to be very low or no risk and was subsequently removed from our program's scope...
Algolia: Hyperlink Injection in Friend Invitation Emails
Description A user can change their last name to a URL in order to send email invitations containing malicious hyperlinks. Steps to Reproduce 1. Create a new Algolia account with the last name http://example.com. 2. Navigate to My Account Referrral 3. Send an invitation to an email address that y...
Instacart: Hyperlink Injection in Friend Invitation Emails
Description A user can change their name to a URL in order to send email invitations containing malicious hyperlinks. Steps to Reproduce 1. Create a new Instacart account with the first name http://example.com 2. Navigate to https://www.instacart.com/store/referrals 3. Send an email invitation to...
The vulnerability of WebSphere Application Server’s application servers allows attackers to inject arbitrary HTTP headers.
The vulnerability of WebSphere Application Server for application servers exists due to the lack of measures to address the CRLF sequence return with a line break. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTTP headers using a specially crafted URL...
Gratipay: User Supplied links on profile page is not validated and redirected via gratipay.
User Supplied links on profile page is not validated and redirected via gratipay. ==================== Description --------------------- The user profiles on gratipay has a profile statement section which is supported by markdown. An adversary can update the profile section with a hyper link URL ...
June 7, 2016, update for Office 2016 (KB3115189)
None None...
Uber: Active Email Hyperlink Sent on riders.uber.com
On riders.uber.com when the rider changes their information an email will be sent to their email informing them a change has been made on their rider account. The rider can change their first name to anything within 45 characters and once the change has been made they can add an email to their...
The vulnerability of the Internet Explorer browser, which allows a violator to obtain confidential information
The vulnerability of the Hyperlink Object Library component in Internet Explorer is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to obtain confidential information through a specially crafted URL in an email message or Office docume...
CVE-2016-0059
The Hyperlink Object Library in Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted URL in a 1 e-mail message or 2 Office document, aka "Internet Explorer Information Disclosure Vulnerability."...
Information disclosure
The Hyperlink Object Library in Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted URL in a 1 e-mail message or 2 Office document, aka "Internet Explorer Information Disclosure Vulnerability."...