UBUNTU-CVE-2016-5268

Mozilla Firefox before 48.0 does not properly set the LINKABLE and URISAFEFORUNTRUSTEDCONTENT flags of about: URLs that are used for error pages, which makes it easier for remote attackers to conduct spoofing attacks via a crafted URL, as demonstrated by misleading text after an about:neterror?d=...

Spoofing attack through text injection into internal error pages — Mozilla

Security researcher musicDespiteEverything reported that some of the special about: URLs used by Firefox to display system information or error messages can incorporate text passed as parameters. These could be used in spoofing attacks...

Apple iOS Spoofing Vulnerability

Apple iOS is an operating system developed for mobile devices. A security vulnerability exists in Safari on Apple iOS that can be exploited by remote attackers to construct malicious web pages that trick users into parsing a spoofed display URL...

spacewalk-java: Multiple XSS flaws

A stored cross-site scripting XSS flaw was found in the way spacewalk-java displayed group names. An attacker can embed HTML and Javascript in the values for group names in Satellite, allowing them to inject malicious content into the web page that is then displayed when viewing the snapshot data...

CVE-2014-9803

arch/arm64/include/asm/pgtable.h in the Linux kernel before 3.15-rc5-next-20140519, as used in Android before 2016-07-05 on Nexus 5X and 6P devices, mishandles execute-only pages, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28557020...

CVE-2014-9803

arch/arm64/include/asm/pgtable.h in the Linux kernel before 3.15-rc5-next-20140519, as used in Android before 2016-07-05 on Nexus 5X and 6P devices, mishandles execute-only pages, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28557020...

CVE-2014-9803

arch/arm64/include/asm/pgtable.h in the Linux kernel before 3.15-rc5-next-20140519, as used in Android before 2016-07-05 on Nexus 5X and 6P devices, mishandles execute-only pages, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28557020...

CVE-2014-9803

arch/arm64/include/asm/pgtable.h in the Linux kernel before 3.15-rc5-next-20140519, as used in Android before 2016-07-05 on Nexus 5X and 6P devices, mishandles execute-only pages, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28557020...

WP-EMail <= 2.67.2 - Cross-Site Scripting (XSS)

If the Plugin is activated then the email submission form can be found on the /email/ directory on individual Post/Pages. For example: http://example.com/2017/05/31/hello-world/email/...

The vulnerability of the cgiPutts function on the CUPS printing server allows a hacker to inject any JavaScript or HTML code into the generated web interfaces.

The vulnerability in the cgiPutts function cgi-bin/template.c of the CUPS printing server is related to insufficient protection of the web page structure. Exploiting this vulnerability allows an attacker to inject arbitrary JavaScript or HTML code into the web pages generated by the system throug...

Oops! TP-Link forgets to Renew and Loses its Domains Used to Configure Router Settings

To make the configuration of routers easier, hardware vendors instruct users to browse to a domain name rather than numeric IP addresses. Networking equipment vendor TP-LINK uses either tplinklogin.net or tplinkextender.net for its routers configuration. Although users can also access their route...

The vulnerability of the Linux operating system, which allows a malicious individual to trigger a service failure

The function trytounmapcluster in the file mm/rmap.c incorrectly handles the list of blocked pages, allowing a malicious actor to cause service failures...

[SECURITY] Fedora 23 Update: php-5.6.23-1.fc23

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

[SECURITY] Fedora 24 Update: struts-1.3.10-18.fc24

Welcome to the Struts Framework! The goal of this project is to provide an open source framework useful in building web applications with Java Servlet and JavaServer Pages JSP technology. Struts encourages application architectures based on the Model-View-Controller MVC design paradigm,...

[SECURITY] Fedora 23 Update: struts-1.3.10-18.fc23

Welcome to the Struts Framework! The goal of this project is to provide an open source framework useful in building web applications with Java Servlet and JavaServer Pages JSP technology. Struts encourages application architectures based on the Model-View-Controller MVC design paradigm,...

Microsoft Edge Memory Corruption Vulnerability (CNVD-2016-04193)

Microsoft Edge is a browser that comes with win10. A memory corruption vulnerability exists in the way the Chakra JavaScript engine used by Microsoft Edge is rendered, allowing remote attackers to exploit the vulnerability to build special WEB pages that users are tricked into parsing, which can...

USN-3006-1 linux vulnerabilities

Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables scatter/gather I/O. A remote attacker could use this to obtain potentially sensitive information from kernel memory. CVE-2016-2117 Jann Horn discovered that eCryptfs improperly attempted to use...

WEBONE CMS service.php etc. 5 SQL injection vulnerability

0x01 vulnerability profile WEBONE CMS in the following 5 branch there is SQL injection vulnerability: 1page service. php GET parameter pk can be a Union injection 2page info. php GET parameter pk can be a Union injection 3Page newscon. php GET parameter pk can be a Union injection 4page photobook...

PHPFox 4 Cross Site Scripting

Title : PhpFox4 Cross Site Scripting Vuln. Author : bl4ckMohajeM [email protected] Software Link: http://www.phpfox.com/ Version: 4 Date : 06/09/2016 Category: WebApps Tested with : Ubuntu / Win Description In this Cms theres is a Cross Site Scripting Vurlnerablities in 'nsextt' Parameter...

The vulnerability of the iOS operating system and the Safari browser allows a perpetrator to trigger a service failure or execute arbitrary code.

The vulnerability of the WebKit component of the iOS operating system and the Safari browser is caused by buffer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or trigger a service failure memory corruption through a specially crafted web page...