CVE-2017-5928

The W3C High Resolution Time API, as implemented in various web browsers, does not consider that memory-reference times can be measured by a performance.now "Time to Tick" approach even with the https://bugzilla.mozilla.org/showbug.cgi?id=1167489c9 protection mechanism in place, which makes it...

CVE-2017-5928

CVE-2017-5928 maps to a timing-related vulnerability in the W3C High Resolution Time API. The issue arises because memory-reference times can be measured in ways Cited as a “Time to Tick” approach, which bypasses protection mechanisms (e.g., Mozilla’s 1167489#c9) and facilitates AnC-style attacks...

Fedora 24 : webkitgtk4 (2016-4728dfe3ec)

This update addresses the following vulnerabilities : - CVE-2016-4622, CVE-2016-4624, CVE-2016-4591, CVE-2016-4590 Additional fixes : - Fix performance in accelerated compositing mode with the modesetting intel driver and DRI3 enabled. - Reduce the amount of file descriptors that the Web Process...

EFF Again Calls for Investigation Around W3C's DRM Extension

Digital rights advocates are again pleading with the World Wide Web Consortium W3C to reconsider standardizing DRM in Encrypted Media Extensions, a draft specification that would ultimately feed into HTML 5. Advocacy groups like the Electronic Frontier Foundation EFF and security researchers alik...

WebUSB API — Connect Your USB Devices Securely to the Internet

Two Google engineers have developed a draft version of an API called WebUSB that would allow you to connect your USB devices to the Web safely and securely, bypassing the need for native drivers. WebUSB – developed by Reilly Grant and Ken Rockot – has been introduced to the World Wide Web...

Microsoft XML Signature HMAC Truncation Bypass (MS10-041) - Ver2 (CVE-2009-0217)

The Microsoft .NET Framework is a component of the Microsoft Windows operating system that enables building and running software applications and Web services. A tampering vulnerability exists in the Microsoft .NET Framework that could allow an attacker to tamper with signed XML content without...

F5 Networks BIG-IP : Expat vulnerabilities (K15905)

CVE-2009-3560 The big2toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service application crash via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related ...

[SECURITY] Fedora 21 Update: xml-security-1.5.7-1.fc21

The XML Security project is aimed at providing implementation of security standards for XML. Currently the focus is on the W3C standards : - XML-Signature Syntax and Processing; and - XML Encryption Syntax and Processing...

[SECURITY] Fedora 20 Update: xml-security-1.5.7-1.fc20

The XML Security project is aimed at providing implementation of security standards for XML. Currently the focus is on the W3C standards : - XML-Signature Syntax and Processing; and - XML Encryption Syntax and Processing...

[SECURITY] Fedora 19 Update: php-htmlpurifier-htmlpurifier-4.6.0-1.fc19

Standards-compliant HTML filter library written in PHP. HTML Purifier will not only remove all malicious code better known as XSS with a thoroughly audited, secure yet permissive white list, it will also make sure your documents are standards compliant, something only achievable with a...

[SECURITY] Fedora 20 Update: php-htmlpurifier-htmlpurifier-4.6.0-1.fc20

Standards-compliant HTML filter library written in PHP. HTML Purifier will not only remove all malicious code better known as XSS with a thoroughly audited, secure yet permissive white list, it will also make sure your documents are standards compliant, something only achievable with a...

W3C Amaya 9.4 legend color Attribute Value Overflow

No description provided by source. source: http://www.securityfocus.com/bid/17507/info W3C Amaya is susceptible to multiple remote buffer-overflow vulnerabilities. These issues are due to the application's failure to properly bounds-check user-supplied data before copying it to insufficiently siz...

W3C Amaya 9.4 textarea rows Attribute Value Overflow

No description provided by source. source: http://www.securityfocus.com/bid/17507/info W3C Amaya is susceptible to multiple remote buffer-overflow vulnerabilities. These issues are due to the application's failure to properly bounds-check user-supplied data before copying it to insufficiently siz...

Puntal 2.1.0 - Remote File Inclusion Vulnerability

No description provided by source. ==================================================== Puntal 2.1.0 Remote File Inclusion Vulnerability ==================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, ...

[SECURITY] Fedora 20 Update: xalan-j2-2.7.1-22.fc20

Xalan is an XSLT processor for transforming XML documents into HTML, text, or other XML document types. It implements the W3C Recommendations for XSL Transformations XSLT and the XML Path Language XPath. It can be used from the command line, in an applet or a servlet, or as a module in other...

[SECURITY] Fedora 19 Update: xalan-j2-2.7.1-22.fc19

Xalan is an XSLT processor for transforming XML documents into HTML, text, or other XML document types. It implements the W3C Recommendations for XSL Transformations XSLT and the XML Path Language XPath. It can be used from the command line, in an applet or a servlet, or as a module in other...

CVE-2014-2242

includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting XSS attacks via an SVG upload, as demonstrated by use of a W...

CVE-2014-2242

includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting XSS attacks via an SVG upload, as demonstrated by use of a W...

[Charles] Web Debugging Proxy Application

Charles is a web proxy HTTP Proxy / HTTP Monitor that runs on your own computer. Your web browser or any other Internet application is then configured to access the Internet through Charles, and Charles is then able to record and display for you all of the data that is sent and received. In Web a...

Google Chrome Eavesdropping Exploit Published

The developer of the annyang speech recognition JavaScript library has published exploit code for a bug in Google’s Chrome browser that could allow a malicious website to eavesdrop using a computer’s microphone long after a visitor has left a website. The code disclosure is in response, said...