Mozilla: Data from Pocket server improperly sanitized before execution (MFSA 2016-94, MFSA 2016-95)

HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" unprivileged page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR 45.6 and Firefox...

MyBB has multiple vulnerabilities (CNVD-2016-11613)

MyBB aka MyBulletinBoard is a free and web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. Multiple security vulnerabilities exist in versions of MyBB prior to 1.8.8 including: SQL injectio...

Multiple vulnerabilities in WSO2 Carbon (CNVD-2016-06405)

WSO2 Carbon is a core platform for developing WSO2 middleware products from WSO2, Inc. A local file inclusion vulnerability, an HTML injection vulnerability, a cross-site scripting vulnerability, and a cross-site request forgery vulnerability exist in WSO2 Carbon version 4.4.5. An attacker could...