1536 matches found
PT-2017-16290
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 59.0.3071.86 for Mac, Windows, and Linux Google Chrome versions prior to 59.0.3071.92 for Android Description The issue is related to a lack of verification of an extension's locale folder in Google Chrome, whic...
CVE-2016-1915
Multiple cross-site scripting XSS vulnerabilities in BlackBerry Enterprise Server 12 BES12 Self-Service before 12.4 allow remote attackers to inject arbitrary web script or HTML via the locale parameter to 1 mydevice/index.jsp or 2 mydevice/loggedOut.jsp...
CVE-2016-1915
Multiple cross-site scripting XSS vulnerabilities in BlackBerry Enterprise Server 12 BES12 Self-Service before 12.4 allow remote attackers to inject arbitrary web script or HTML via the locale parameter to 1 mydevice/index.jsp or 2 mydevice/loggedOut.jsp...
PT-2017-7985
Name of the Vulnerable Software and Affected Versions BlackBerry Enterprise Server 12 versions prior to 12.4 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the locale paramet...
Solaris x86 / SPARC EXTREMEPARR dtappgather Privilege Escalation
!/bin/ksh Exploit PoC reverse engineered from EXTREMEPARR which provides local root on Solaris 7 - 11 x86 & SPARC. Uses a environment variable of setuid binary dtappgather to manipulate file permissions and create a user owned directory anywhere on the system as root. Can then add a shared object...
CVE-2016-1915: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in BlackBerry Enterprise Server 12 BES12 Self-Service before 12.4 allow remote attackers to inject arbitrary web script or HTML via the locale parameter to 1 mydevice/index.jsp or 2 mydevice/loggedOut.jsp...
Solaris 7 < 11 (SPARC/x86) - 'EXTREMEPARR' dtappgather Privilege Escalation
!/bin/ksh Exploit PoC reverse engineered from EXTREMEPARR which provides local root on Solaris 7 - 11 x86 & SPARC. Uses a environment variable of setuid binary dtappgather to manipulate file permissions and create a user owned directory anywhere on the system as root. Can then add a shared object...
Inchoo Facebook Connect Cross Site Scripting
https://www.osisecurity.com.au/inchoo-facebook-connect-extension-for-magento-parameter-xss.html Date: 04-Apr-2017 Product: Inchoo Facebook Connect Magento Plugin Vulnerability: Reflected cross-site scripting. Details: Within ./app/code/community/Inchoo/Facebook/Block/Channel.php return 'isSecure ...
HotelCMS with Booking Engine - SQL injection vulnerability
http://localhost/PATH/locale? locale=SQL the locale parameter there is sql injection Wherein the error injection as follows: payload: http://localhost/PATH/locale? locale=1' AND SELECT 3507 FROMSELECT COUNT,CONCATFLOORRAND02,md5233x FROM INFORMATIONSCHEMA. The PLUGINS GROUP BY xa-- Lilt Test...
USN-3196-1 php5 vulnerabilities
It was discovered that PHP incorrectly handled certain arguments to the localegetdisplayname function. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2014-9912 It was discovered that PHP incorrectly handled...
ICU: Multiple vulnerabilities
Background ICU is a mature, widely used set of C/C++ and Java libraries providing Unicode and Globalization support for software applications. Description Multiple vulnerabilities have been discovered in ICU. Please review the CVE identifiers referenced below for details. Impact Remote attackers...
openSUSE Security Update : syncthing / syncthing-gtk (openSUSE-2017-30)
This updates syncthing to version 0.14.16 and fixes the following issues : The following security issue was fixed : - A remote device that was already accepted by syncthing could perform arbitrary reads and writes outside of the configured directories boo1016161 This update also contains a number...
CVE-2014-9912
The geticudispvaluesrcphp function in ext/intl/locale/localemethods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service buffer overflow or possibly have...
CVE-2014-9912
The geticudispvaluesrcphp function in ext/intl/locale/localemethods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service buffer overflow or possibly have...
PT-2017-4186
Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.3.29 PHP versions 5.4.x prior to 5.4.30 PHP versions 5.5.x prior to 5.5.14 Description The issue is related to the get icu disp value src php function, which does not properly restrict calls to the ICU uresbund.cpp...
UBUNTU-CVE-2014-9912
The geticudispvaluesrcphp function in ext/intl/locale/localemethods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service buffer overflow or possibly have...
CVE-2014-9912: Improper Restriction of Operations within the Bounds of a Memory Buffer
The geticudispvaluesrcphp function in ext/intl/locale/localemethods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service buffer overflow or possibly have...
Starbucks: Reflected XSS on teavana.com (Locale-Change)
SUMMARY ---- Hello, the link at https://www.teavana.com/on/demandware.store/Sites-Teavana-Site/default/Locale-Change?LocaleID=enCA was identified by changing languages is prone to reflected XSS in the "en" zone of the LocaleID parameter. One can inject javascript that will be reflected back to th...
