Mozilla Firefox Address Bar Forgery Vulnerability (CNVD-2015-06287)

Mozilla Firefox is an open source web browser. Mozilla Firefox has an unspecified security vulnerability that allows remote attackers to construct malicious web pages that can be tricked into being parsed by users, and can spoof address bar properties...

Vulnerabilities of browsers Internet Explorer and Microsoft Edge, allowing a perpetrator to execute arbitrary code or trigger a service failure

The vulnerabilities of Internet Explorer and Microsoft Edge are caused by buffer overflows. Exploiting these vulnerabilities allows a malicious actor to execute arbitrary code or cause a denial-of-service attack using a specially crafted web page...

How to Display Custom Error Pages by Using NetScaler Responder Policies

This article contains information about configuring Responder policies that redirect user requests to custom error pages during a maintenance period of a back end web server farm. Background You can create custom error page and redirect the user requests to it. For example, you might want to host...

WordPress Landing Pages 1.8.4 Cross Site Scripting ( CVE-2015-4065 )

插件: https://downloads.wordpress.org/plugin/landing-pages.1.8.4.zip 漏洞文件位置在 shared/shortcodes/inbound-shortcodes.php Line 761 preview.php?sc=&post=' width="285" scrollbar='true' frameborder="0" id="inbound-shortcodes-preview" 从上述文件可以看到 GET 方式传过来的参数 post 直接输出到 html 中造成了XSS 触发 url 如下...

Apple iOS Webkit Memory Corruption Vulnerability (CNVD-2015-06168)

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A memory corruption vulnerability exists in Webkit used by Apple iOS, which allows attackers to construct a malicious web page and trick users into parsing it, which could crash the application or execute...

Apple iOS Webkit Memory Corruption Vulnerability (CNVD-2015-06172)

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A memory corruption vulnerability exists in Webkit used by Apple iOS, which allows attackers to construct malicious web pages that can be tricked into being parsed by users, which can crash the applicatio...

Apple iOS Webkit Memory Corruption Vulnerability (CNVD-2015-06177)

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A memory corruption vulnerability exists in Webkit used by Apple iOS, which allows attackers to construct malicious web pages that can be tricked into being parsed by users, which can crash the applicatio...

Apple iOS WebKit Memory Corruption Vulnerability (CNVD-2015-06126)

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A memory corruption vulnerability exists in the Apple iOS WebKit engine, which allows remote attackers to construct a malicious web page and trick users into parsing it, which could crash the application ...

Apple iOS Webkit Information Disclosure Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A vulnerability in Apple iOS Webkit's handling of the Content-Disposition header that contains type attachments allows attackers to construct malicious web pages that can be parsed by tricking the user in...

Apple iOS Safari User Interface Forgery Vulnerability (CNVD-2015-06199)

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A security vulnerability exists in Apple iOS Safari, which allows attackers to exploit a vulnerability to build malicious web pages that can be tricked into parsing, which can spoof the user interface...

Orient Technologies Studio for OrientDB Server Community Edition Clickjacking Vulnerability

Orient Technologies Studio for OrientDB Server Community Edition is a community edition of OrientDB Server from Orient Technologies, UK. Orient Technologies Studio for OrientDB Server Community Edition fails to enforce the same-origin policy by default in the X-Frame-Options response header,...

Apple iOS Webkit Memory Corruption Vulnerability (CNVD-2015-06145)

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A memory corruption vulnerability exists in Webkit used by Apple iOS, which allows attackers to construct malicious web pages that can be tricked into being parsed by users, which can crash the applicatio...

CVE-2015-7232

Cross-site scripting XSS vulnerability in unspecified administration pages in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology module is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Koritore vulnerable to URL whitelist bypass

Overview Koritore provided by Newphoria Corporation Inc. is an application for both iOS or Android built using "applican". Koritore contains an issue where an arbitrary page may be loaded if the application is launched using the URL-scheme. Kenta Suefusa and Tomonori Shiomi of Sprout Inc. reporte...

MEGAPHONE MUSIC vulnerable to URL whitelist bypass

Overview MEGAPHONE MUSIC provided by Newphoria Corporation Inc. is an application for both iOS or Android built using "applican". MEGAPHONE MUSIC contains an issue where an arbitrary page may be loaded if the application is launched using the URL-scheme. Kenta Suefusa and Tomonori Shiomi of Sprou...

Zen Cart 1.5.4 Code Execution / Information Disclosure

Zen Cart 1.5.4: Code Execution and Information Leak Security Advisory – Curesec Research Team 1. Introduction Affected Product: Zen Cart 1.5.4 Fixed in: partial fix via patch Partial Patch Link: https://www.zen-cart.com/showthread.php?218239-curesec-security-report-Patch-Included Vendor Contact:...

The vulnerability of the iOS operating system allows a hacker to replace the actual clicks with clicking on URL links.

The vulnerability of the WebKit component of the iOS operating system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to substitute actual clicks on URL links with clicks on specially crafted web pages...

Google Chrome decompose() denial of service vulnerability

Google Chrome is a WEB-based browser. The decompose function in platform/transforms/TransformationMatrix.cpp in Google Chrome Blink does not validate that the matrix inversion was successful, allowing remote attackers to construct malicious WEB pages and trick users into parsing them, which can...

MediaWiki cross-site scripting vulnerability (CNVD-2015-05878)

MediaWiki is a free, free web-based wiki engine developed and maintained by the Wikimedia Foundation and MediaWiki volunteers, which can be used to deploy internal knowledge management and content management systems. MediaWiki suffers from a cross-site scripting vulnerability that allows remote...

Google Chrome WebRequest API Access Restriction Bypass Vulnerability

Google Chrome is a WEB-based browser. The WebRequest API implementation in Google Chrome extensions/browser/api/webrequest/webrequestapi.cc fails to properly consider the source of the request, which allows remote attackers to construct malicious WEB pages that trick users into parsing them to...