3694 matches found
CVE-2017-5046
Removed by vendor...
CVE-2017-5046
CVE-2017-5046 (Chrome/Blink): V8 policy enforcement flaw allowed a remote attacker to spoof the location object via a crafted HTML page, related to Blink information disclosure. Affected: Google Chrome prior to 57.0.2987.98 on Mac/Windows/Linux and 57.0.2987.108 on Android. Impact is information ...
CVE-2017-5060
Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name...
CVE-2017-5046
V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android had insufficient policy enforcement, which allowed a remote attacker to spoof the location object via a crafted HTML page, related to Blink information disclosure...
passfault - OWASP Passfault evaluates passwords and enforces password policy in a completely different way
Objective: Do Passwords Better! Running the Command-line Interface: 1. install java 2. cd core 3. gradlew installDist 4. run build/install/core/bin/core Running the jsonWebService: 1. cd jsonService 2. gradlew build jettyRunWar 3. browse to localhost:8080/jsonService Note the war will be located ...
F5 Networks BIG-IP : libxml2 vulnerability (K14338030)
The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted XML document. CVE-2016-1762 File data f5bigipSOL14338030.nasl...
New Google Tools Help Devs Improve Content Security Policy Protection
Cross-site scripting is the cockroach of web application security vulnerabilities, enjoying continued longevity despite the abundant availability of scanning tools and programming advice designed to squash it. Google yesterday took another shot at eradicating XSS attacks with the release of two...
Symantec Endpoint Protection Manager 12.1 - Multiple Vulnerabilities
Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SYMANTEC-SEPM-MULTIPLE-VULNS.txt + ISR: ApparitionSec Vendor: ================ www.symantec.com Product: =========== SEPM Symantec Endpoint Protection Manager and client v12.1...
Google makes it mandatory for Chrome Apps to tell Users what Data they collect
In Brief Chrome apps and extensions make things easier, but they can also do terrible things like spy on web users and collect their personal data. But, now Google has updated its browser’s User Data Policy requiring all Chrome extension and app developers to disclose what data they collect...
Google Stresses Transparency in New Chrome Web Store Policies
Google last week put app developers on notice, urging them to comply with a new set of privacy policies that it plans on enforcing starting this summer designed to better promote transparency. The rules reflect an update to Google’s User Data Policy for the Chrome Web Store. The company has porte...
UBUNTU-CVE-2015-4490
The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob, data, and filesystem URL schemes during wildcard source-expression matching, which might make it easier for remote...
F5 Networks BIG-IP : GnuTLS vulnerability (SOL15637)
The gnutlsciphertext2compressed function in lib/gnutlscipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service buffer over-read and crash via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169. C Tenable Network Security, Inc. The...
Symantec Endpoint Protection Client < 11.0.7.4 / 12.1.2 (SYM14-001)
The version of Symantec Endpoint Protection Client running on the remote host is either 11.x prior to 11.0.7.4 or 12.x prior to 12.1.2 RU2. It is, therefore, affected by multiple security vulnerabilities : - The Application/Device Control in the SEP Client does not properly enforce custom policie...
CVE-2013-6426
The cloudformation-compatible API in OpenStack Orchestration API Heat before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to bypass intended access restrictions and 1 create a stack via the CreateStack method or 2 upda...
CVE-2013-6426
The CVE-2013-6426 issue affects OpenStack Heat’s cloudformation-compatible API, where policy enforcement was inadequate, allowing in-instance users to create or update stacks via CreateStack/UpdateStack and bypass restrictions. Public disclosures in SUSE and Red Hat advisories confirm the problem...
Moderate: Red Hat Security Advisory: openstack-glance security and bug fix update
Updated openstack-glance packages that fix one security issue and several bugs are now available for Red Hat OpenStack 3.0. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...
Ubuntu: Security Advisory (USN-2003-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-2003-1: Glance vulnerability
Stuart McLaren discovered that Glance did not properly enforce the 'downloadimage' policy for cached images. An authenticated user could exploit this to obtain sensitive information in an image protected by this setting...
Barracuda LB, SVF, WAF & WEF - Multiple Vulnerabilities
Document Title: =============== Barracuda LB, SVF, WAF & WEF - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=727 Note: The issue was part of the official Barracuda Networks Bug Bounty Program. Release Date: =============...
