CVE-2018-8070

QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI...

CVE-2018-8070

CVE-2018-8070 describes an XSS vulnerability in QCMS 3.0 triggered by the title parameter to the /guest/index.html URI. The issue is due to improper handling of user-supplied input in that parameter, enabling cross-site scripting. Multiple connected sources (Red Hat, CNVD, and others) confirm the...

QCMS Cross-Site Scripting Vulnerability

QCMS is an open source content management system CMS for creating responsive websites. A cross-site scripting vulnerability exists in QCMS version 3.0. A remote attacker can exploit this vulnerability by sending the 'webname' parameter to the /backend/system.html URI to inject arbitrary web scrip...

The vulnerability of the Firefox browser allows a remote attacker to gain access to the dynamic memory of the process or trigger a service denial-of-service attack.

The vulnerability of the Firefox browser in the implementation of the QCMS component allows a malicious actor to gain access to confidential information from the dynamic memory of the process, or to trigger a service failure reading beyond the boundaries of the system by using an image that is...

The vulnerability of the Firefox ESR browser allows a malicious attacker to execute arbitrary code or trigger a service denial.

Mozilla Firefox ESR software contains a vulnerability in the qcmsprofilefrommemory function. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure by manipulating the web notification API component, thereby creating a custom ICC profile...

The vulnerability of the Firefox browser, which allows a malicious attacker to execute arbitrary code or trigger a service denial.

Mozilla Firefox’s software contains a vulnerability in the qcmsprofilefrommemory function. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure by manipulating the web notification API component, thereby creating a custom ICC profile...

The vulnerability of the SeaMonkey software package allows a malicious attacker to execute arbitrary code or cause a service failure.

The SeaMonkey software contains a vulnerability in the qcmsprofilefrommemory function. Exploiting this vulnerability allows an unauthorized attacker to execute arbitrary code or cause a service failure by manipulating the web notification API component, thereby creating a special ICC profile...

Horizon QCMS 4.0 'category' 参数SQL注入漏洞

受影响系统 Horizon QCMS Horizon QCMS 测试方法： -------------------------------------------------------------------------------- 警 告 以下程序方法可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！ http://host/download.php?category=%27%20union%20select%201,2,version,4,5,6%20--%202 建议：...

The vulnerability of the Firefox browser, which allows a perpetrator to gain access to protected information or cause a service failure

The vulnerability of the lutinverseinterp16 function in the QCMS library of the Firefox browser is caused by buffer overflow. Exploiting this vulnerability can allow a malicious actor to gain access to protected information or cause service failures using a specially crafted image...

Mozilla Firefox QCMS Library Buffer Overflow Vulnerability

Mozilla Firefox is an open source web browser. A security vulnerability exists in the 'lutinverseinterp16' function in the Mozilla Firefox QCMS library. A remote attacker could exploit specially crafted attributes in an image's ICC 4 profile to obtain sensitive information or conduct a...

CVE-2015-4504

The lutinverseinterp16 function in the QCMS library in Mozilla Firefox before 41.0 allows remote attackers to obtain sensitive information or cause a denial of service buffer over-read and application crash via crafted attributes in the ICC 4 profile of an image...

Design/Logic Flaw

The lutinverseinterp16 function in the QCMS library in Mozilla Firefox before 41.0 allows remote attackers to obtain sensitive information or cause a denial of service buffer over-read and application crash via crafted attributes in the ICC 4 profile of an image...

CVE-2015-4504

Mozilla Firefox contains a vulnerable entry for CVE-2015-4504 in the QCMS library: lut_inverse_interp16 allows remote attackers to read sensitive data or crash the browser via crafted ICC v4 profile attributes, due to an out-of-bounds read. Affected versions are Firefox before 41.0. Mitigation: u...

USN-2743-2 ubufox update

USN-2743-1 fixed vulnerabilities in Firefox. This update provides the corresponding update for Ubufox. Original advisory details: Andrew Osmond, Olli Pettay, Andrew Sutherland, Christian Holler, David Major, Andrew McCreight, Cameron McCormack, Bob Clary and Randell Jesup discovered multiple memo...

USN-2743-1 firefox vulnerabilities

Andrew Osmond, Olli Pettay, Andrew Sutherland, Christian Holler, David Major, Andrew McCreight, Cameron McCormack, Bob Clary and Randell Jesup discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially explo...

Out of bounds read in QCMS library with ICC V4 profile attributes — Mozilla

Security researcher Felix Gröbert of Google discovered an out of bounds read in the QCMS color management library while manipulating an image with specific attributes in its ICC V4 profile. This causes a crash and could lead to information disclosure...

UBUNTU-CVE-2015-4504

The lutinverseinterp16 function in the QCMS library in Mozilla Firefox before 41.0 allows remote attackers to obtain sensitive information or cause a denial of service buffer over-read and application crash via crafted attributes in the ICC 4 profile of an image...

Mozilla Firefox Multiple Vulnerabilities-01 (Apr 2015) - Mac OS X

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

USN-2550-1 firefox vulnerabilities

Olli Pettay and Boris Zbarsky discovered an issue during anchor navigations in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin policy restrictions. CVE-2015-0801 Bobby Holley discovered that...

CVE-2015-0811

The QCMS implementation in Mozilla Firefox before 37.0 allows remote attackers to obtain sensitive information from process heap memory or cause a denial of service out-of-bounds read via an image that is improperly handled during transformation...