CVE-2015-7214

CVE-2015-7214 affects Mozilla Firefox before 43.0 and Firefox ESR before 38.5. A cross-site read bypass of the Same Origin Policy is possible via data: and view-source: URIs, allowing an attacker to read data from cross-site URLs and local files. Connected sources confirm the bypass vector and in...

CVE-2015-7214

Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-source: URIs...

Android intents can be used on Firefox for Android to open privileged files — Mozilla

Security researcher Muneaki Nishimura reported that on Firefox for Android, a search engine can be registered and used to launch Firefox through an Android intent. When Firefox for Android is launched, the URL can executed with Firefox's system privileges if the crash reporter is used. This allow...

AlienVault OSSIM Cross-Site Request Forgery Vulnerability

AlienVault OSSIM is an open source security information management system. AlienVault OSSIM suffers from a cross-site request forgery vulnerability that allows remote attackers to construct malicious URIs, trick users into parsing them, and can perform malicious actions in the context of the targ...

Firefox PDF.js Privileged Javascript Injection Exploit

This Metasploit module gains remote code execution on Firefox 35-36 by abusing a privilege escalation bug in resource:// URIs. PDF.js is used to exploit the bug. This exploit requires the user to click anywhere on the page to trigger the vulnerability. This module requires Metasploit:...

Cisco TelePresence Serial Gateway Device Cross-Site Request Forgery Vulnerability

The Cisco TelePresence Serial Gateway is an integrated gateway device for web and serial video networks. A cross-site request forgery vulnerability exists in the Cisco TelePresence Serial Gateway appliance that allows remote attackers to construct malicious URIs, trick users into parsing them, an...

Cisco TelePresence IP Gateway Device Cross-Site Request Forgery Vulnerability

The Cisco TelePresence IP Gateway is a telepresence IP gateway device. A cross-site request forgery vulnerability exists in the Cisco TelePresence IP Gateway appliance that allows remote attackers to construct malicious URIs, trick users into parsing them, and can perform malicious actions in the...

Apple iOS Safari Cross-Site Request Forgery Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A cross-site request forgery vulnerability exists in Safari, which is used by Apple iOS, allowing remote attackers to construct malicious URIs, trick users into parsing them, and can perform malicious...

Drupal Decisions Module Cross-Site Request Forgery Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site request forgery vulnerability exists in Drupal Decisions, which allows remote attackers to construct malicious URIs, trick users into parsing them, and can target user contexts to perform malicious actions...

Cisco MediaSense Cross-Site Request Forgery Vulnerability

Cisco MediaSense provides recording, playback, live streaming, and storage media, including audio and video, to improve customer service. A cross-site request forgery vulnerability exists in Cisco MediaSense that allows remote attackers to construct malicious URIs, trick users into parsing them,...

Drupal Keyword Research Module Cross-Site Request Forgery Vulnerability

Drupal is an open source content management system.Keyword Research is a module that provides keywords for searches. A cross-site request forgery vulnerability exists in the Drupal Keyword Research module that allows remote attackers to construct malicious URIs, trick users into parsing them, and...

Advisory: CVE-2014-9707: GoAhead Web Server 3.0.0 - 3.4.1

Affected software: GoAhead Web Server Affected versions: 3.0.0 - 3.4.1 3.x.x series before 3.4.2 CVE ID: CVE-2014-9707 Description: The server incorrectly normalizes HTTP request URIs that contain path segments that start with a "." but are not entirely equal to "." or ".." eg. ".x". By sending a...

Xeams /FrontController Cross-Site Request Forgery Vulnerability

Xeams is an email server. A cross-site request forgery vulnerability exists in Xeams /FrontController, which allows remote attackers to construct malicious URIs, trick users into parsing them, and can target user contexts to perform malicious actions...

SearchBlox Cross-Site Request Forgery Vulnerability

SearchBlox is an enterprise search solution , built on Lucene . SearchBlox has a cross-site request forgery vulnerability that allows remote attackers to construct malicious URIs, trick users into parsing them, and can perform malicious operations in the context of the target user...

Kallithea /_admin/my_account Admin account password manipulation vulnerability

Kallithea is a free source code management system. Kallithea suffers from a security vulnerability that allows remote attackers to construct malicious URIs, trick users into parsing them, and perform malicious actions, such as changing a user's password, in the context of the target user...

Multiple Reflected Cross-Site Scripting Vulnerabilities in Kemp Virtual LoadMaster

Kemp Virtual LoadMaster is a virtual load balancer. Kemp Virtual LoadMaster suffers from multiple cross-site scripting vulnerabilities that can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies, hijack...

Citrix NetScaler Nitro API Cross-Site Request Forgery Vulnerability

Citrix NetScaler is a network traffic management product. A cross-site request forgery vulnerability exists in the Citrix NetScaler Nitro API, which allows remote attackers to construct malicious URIs, trick users into parsing them, and can target user contexts to perform malicious actions such a...

Websense TRITON AP-EMAIL Clickjacking Vulnerability

Websense TRITON is a unified content architecture to protect data security. A clickjacking vulnerability exists in Websense TRITON AP-EMAIL, which allows attackers to construct malicious URIs, trick users into parsing them, and spoof user communications...

MikroTik RouterOS Cross-Site Request Forgery Vulnerability

MikroTik RouterOS is an operating system for routers. MikroTik RouterOS suffers from a cross-site request forgery vulnerability that allows remote attackers to construct malicious URIs, trick users into parsing them, and can perform malicious actions, such as changing passwords, in the context of...

IBM WebSphere Cross-Site Scripting Vulnerability

IBM WebSphere Portal provides a framework for combining application or business mashups and provides a high-level tool to construct flexible, SOA-based solutions. A cross-site scripting vulnerability exists in IBM WebSphere Portal, which can be exploited by a remote attacker to construct maliciou...