OkCupid: XSS on Send A Message Option

Attacker can send XSS Payload through Message Option . POC: https://www.dropbox.com/s/ieoeu6bw4bj7dqt/xss.mkv?dl=0...

SA-CONTRIB-2015-054 - SMS Framework - Cross Site Scripting (XSS)

SMS Framework module enables you to send and receive SMS messages from and into Drupal. The module doesn't sufficiently sanitize user supplied text in message previews, thereby exposing a reflected Cross Site Scripting vulnerability. An attacker could exploit this vulnerability by getting the...

PT-2015-3583

Name of the Vulnerable Software and Affected Versions glibc versions prior to 2.20 Description The issue arises from the send dg function in resolv/res send.c, which fails to properly reuse file descriptors. This allows remote attackers to send DNS queries to unintended locations by triggering a...

UBUNTU-CVE-2014-8638

The navigator.sendBeacon implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 omits the CORS Origin header, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery...

PT-2015-3617

Name of the Vulnerable Software and Affected Versions Sendy version 1.1.9.1 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the c parameter in the "/send-to" API endpoint. Recommendations For Sendy version 1.1.9.1, avoid using the ...

Mozilla: XMLHttpRequest crashes with some input streams (MFSA 2014-85)

The XMLHttpRequest.prototype.send method in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to cause a denial of service application crash via a crafted JavaScript object...

PT-2014-8746

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.17.4 Description The issue is a stack-based buffer overflow in the ttusbdecfe dvbs diseqc send master cmd function, which can be triggered by a large message length in an ioctl call. This can cause a denial of...

X7 Chat 2.0.5 lib/message.php preg_replace() PHP Code Execution

No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include...

Updated zabbix package fixes security vulnerability

It was reported that the Zabbix frontend supported an XML data import feature, where on the server it used DOMDocument to parse the XML. By default, DOMDocument also parses the external DTD, which could allow a remote attacker to use a crafted XML file causing Zabbix to read an arbitrary local...

CVE-2014-8308: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Send to Inbox functionality in SAP BusinessObjects BI EDGE 4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2014-8457

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects BI EDGE version 4.0 Description A cross-site scripting XSS issue exists in the Send to Inbox functionality, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For SAP...

CVE-2014-6394

visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory...

CVE-2014-6394

visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory...

UBUNTU-CVE-2014-6394

visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory...

CVE-2014-6394

visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory...

CVE-2014-6394: Improper Limitation of a Pathname to a Restricted Directory

visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory...

Fedora Update for nodejs-send FEDORA-2014-11495

Check the version of nodejs-send SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.868362";...

Fedora Update for nodejs-send FEDORA-2014-11421

Check the version of nodejs-send SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.868365";...

Design/Logic Flaw

vmdb/app/controllers/applicationcontroller/performance.rb in Red Hat CloudForms 3.1 Management Engine CFME before 5.3 allows remote authenticated users to gain privileges via unspecified vectors, related to an "insecure send method."...

CVE-2014-3642

vmdb/app/controllers/applicationcontroller/performance.rb in Red Hat CloudForms 3.1 Management Engine CFME before 5.3 allows remote authenticated users to gain privileges via unspecified vectors, related to an "insecure send method."...