The two did not repair the vulnerabilities affect the mainstream browser extension system-vulnerability warning-the black bar safety net

Security researchers found that the two did not fix the vulnerability embedded in many mainstream browsers in the expansion of the system, such as Firefox, Safari, and all with Chromium related browsers such as Chrome, Opera, etc. ! An attacker can exploit these vulnerabilities expose the user of...

Cross-Site Scripting (XSS)

zend-diactoros is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary javascript through the URI of a generated form...

Cross site scripting

Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting XSS or open redirect attacks...

CVE-2015-3257

Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting XSS or open redirect attacks...

CVE-2015-3257

Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting XSS or open redirect attacks...

SAP NetWeaver K.M. Web Page Composer URI Redirection Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A URI redirection vulnerability exists in SAP NetWeaver K.M. Web Page Composer due to the application failing to...

PT-2017-6655

Name of the Vulnerable Software and Affected Versions zend-diactoros versions prior to 1.0.4 Description The issue arises from improper sanitization of path input by Zend/Diactoros/Uri::filterPath in zend-diactoros, allowing remote attackers to perform cross-site scripting XSS or open redirect...

CVE-2015-3257: Improper Neutralization of Input During Web Page Generation

Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting XSS or open redirect attacks...

CVE-2015-4699

Cross-site scripting XSS vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to inject arbitrary web script or HTML via the recoveryMessage parameter to the default URI...

Cross site scripting

Cross-site scripting XSS vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to inject arbitrary web script or HTML via the recoveryMessage parameter to the default URI...

CVE-2015-4699

Cross-site scripting XSS vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to inject arbitrary web script or HTML via the recoveryMessage parameter to the default URI...

chm.uri.edu XSS vulnerability

Vulnerable URL: https://www.chm.uri.edu/chemsite2013/index.php?email=%22%3E%3Csvg/onload=alert/XSSPOSED/%3E=facpage=Faculty%20and%20Research=index.php?dest=facres=facres Details: Description| Value ---|--- Patched:| No Latest check for patch:| 22.11.2017 Vulnerability type:| XSS Vulnerability...

Atlassian OAuth Server-Side Request Forgery Vulnerability

Atlassian OAuth Plugin is an authorization plugin from Atlassian Australia for accessing personal Atlassian software data. A security vulnerability exists in the IconUriServlet in the Atlassian OAuth Plugin. A remote attacker could exploit the vulnerability to access internal network resources or...

Hiking Club Malvertisements Drop Monero Miners Via Neptune Exploit Kit

Exploit kit EK activity has been on the decline ever since Angler Exploit Kit was shut down in 2016. Fewer people using Internet Explorer and a drop in browser support for Adobe Flash – two primary targets of many exploit kits – have also contributed to this decline. Additionally, some popular...

Hiking Club Malvertisements Drop Monero Miners Via Neptune Exploit Kit

Exploit kit EK activity has been on the decline ever since Angler Exploit Kit was shut down in 2016. Fewer people using Internet Explorer and a drop in browser support for Adobe Flash – two primary targets of many exploit kits – have also contributed to this decline. Additionally, some popular...

CVE-2015-3649

The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" followed by a crafted UID, and putting Ruby code in said directory once a meta file is created...

Code injection

The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" followed by a crafted UID, and putting Ruby code in said directory once a meta file is created...

CVE-2015-3649

The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" followed by a crafted UID, and putting Ruby code in said directory once a meta file is created...

CVE-2015-3649

The CVE-2015-3649 entry concerns the Ruby gem open-uri-cached. Affected component: open-uri-cached Ruby gem; root cause: insecure/predictable temporary file handling in /tmp, where a directory named with openuri- and a meta/marker file is created, allowing a local attacker to place Ruby code and ...

CVE-2015-3649

The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" followed by a crafted UID, and putting Ruby code in said directory once a meta file is created...