UBUNTU-CVE-2015-6777

Use-after-free vulnerability in the ContainerNode::notifyNodeInsertedInternal function in WebKit/Source/core/dom/ContainerNode.cpp in the DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via...

WordPress Slideshow Plugin <= 2.1.14 - Multiple Script Insertion Vulnerabilities

This plugin is prone to multiple script insertion vulnerabilities. Attackers can conduct script insertion attacks. Solution Update plugin...

WordPress Slideshow Plugin <= 2.1.14 - Multiple Script Insertion Vulnerabilities

This plugin is prone to multiple script insertion vulnerabilities. Attackers can conduct script insertion attacks. Solution Update plugin...

IBM Security QRadar Incident Forensics Cross-Site Request Forgery Vulnerability

IBM Security QRadar Incident Forensics is a suite of security forensic investigation software from IBM. The software supports in-depth forensic investigations of suspected malicious network security incidents, and repair network security vulnerabilities. A cross-site request forgery vulnerability...

CVE-2015-1997: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in IBM Security QRadar Vulnerability Manager 7.2.x before 7.2.5 Patch 5 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

Allen-Bradley MicroLogix Arbitrary File Insertion Vulnerability

Allen-Bradley MicroLogix is a programmable logic controller PLC from Rockwell Automation. An arbitrary file insertion vulnerability exists in Allen-Bradley MicroLogix 1100 before B FRN 15.000 and 1400 before B FRN 15.003. It allows an authenticated remote user to insert the contents of an arbitra...

CVE-2015-6491

Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote authenticated users to insert the content of an arbitrary file into a FRAME element via unspecified vectors...

CVE-2015-6491

Rockwell Automation MicroLogix 1100 and 1400 PLCs are affected by CVE-2015-6491. Specifically, MicroLogix 1100 controllers (Series B) with firmware version 14.000 and earlier are mitigated by updating to 15.000, while MicroLogix 1400 controllers (Series B) with firmware 15.003 and earlier require...

CVE-2015-6491: Undefined Security Weakness

Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote authenticated users to insert the content of an arbitrary file into a FRAME element via unspecified vectors...

USN-2770-1: Oxide vulnerabilities

It was discovered that ContainerNode::parserInsertBefore in Blink would incorrectly proceed with a DOM tree insertion in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same origin restrictions. CVE-2015-67...

USN-2770-1 oxide-qt vulnerabilities

It was discovered that ContainerNode::parserInsertBefore in Blink would incorrectly proceed with a DOM tree insertion in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same origin restrictions. CVE-2015-67...

Code injection

The ContainerNode::parserInsertBefore function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 46.0.2490.71, proceeds with a DOM tree insertion in certain cases where a parent node no longer contains a child node, which allows remote attackers to bypass the Same Origin...

CVE-2015-6755

The ContainerNode::parserInsertBefore function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 46.0.2490.71, proceeds with a DOM tree insertion in certain cases where a parent node no longer contains a child node, which allows remote attackers to bypass the Same Origin...

CVE-2015-6755

CVE-2015-6755 affects Blink (ContainerNode::parserInsertBefore in core/dom/ContainerNode.cpp) used by Google Chrome prior to 46.0.2490.71. The issue allows bypassing the Same Origin Policy via crafted JavaScript that triggers a DOM tree insertion even when a parent node no longer contains a child...

CVE-2015-6755

Removed by vendor...

CVE-2015-6755

The ContainerNode::parserInsertBefore function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 46.0.2490.71, proceeds with a DOM tree insertion in certain cases where a parent node no longer contains a child node, which allows remote attackers to bypass the Same Origin...

Cisco TelePresence Video Communication Server Expressway File Modification Vulnerability (cisco-sa-20151007-vcs)

A vulnerability in the symbolic link operation of the Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, local attacker to perform a symbolic link attack on the affected system. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be...

thinksaas最新版存储xss

简要描述： 过滤不当 详细说明： 最新版下载地址http://www.thinksaas.cn/service/down/ 跟前面thinksaas最新版xss2 WooYun: thinksaas最新版xss2 thinksaas最新版xss WooYun: thinksaas最新版xss 原理都一样 吐槽下 官网不让注册帐号 就在本地测试了 前人的我测试一个现在还可以 当然 漏洞文件肯定是不一样的 漏洞文件 在app/article/action/add.php 25行中没有过滤 48行插入数据库 isLogin; switch $ts case "" : if...

DESTOON sql注入漏洞

简要描述： DESTOON sql注入漏洞 详细说明： 一枚二次注入,因为使用了dhtmlspecialchars导致防注入失效。可以任意数据。 先来看留言模块： \module\extend\comment.inc.php $item = $db-getone"SELECT title,linkurl,username,status FROM ".gettable$mid." WHERE itemid=$itemid"; //从数据库中取出对于模块的发布数据 $item or exit; $item'status' 2 or exit; $linkurl =...

eBay Magento Persistent Script Insertion

Document Title: =============== Ebay Magento Bug Bounty 10 - Persistent Filename Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1457 eBay Inc. Bug Bounty Program ID: EIBBP-31603 Video: https://www.youtube.com/watch?v=WffsHd8pibE Release...