UBUNTU-CVE-2016-5292

During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Firefox 50...

cURL/libcURL Security Bypass Vulnerability (CNVD-2016-10793)

cURL/libcURL is a command line file transfer tool that supports FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET, DICT, FILE and LDAP. A security bypass vulnerability exists in cURL/libcURL due to a "" ending in an illegal url, which allows attackers to bypass security restrictions and perform unauthorized...

Citrix NetScaler ADC URL Redirection Vulnerability

Citrix NetScaler ADCs are application delivery controllers that optimize enterprise service delivery. A URL redirection vulnerability exists in Citrix NetScaler ADC. An attacker could exploit this vulnerability to allow users to access the attacker's malicious links without notice...

Rotten Apples: Resurgence

In June 2016, we published a blog about a phishing campaign targeting the Apple IDs and passwords of Chinese Apple users that emerged in the first quarter of 2016 referred to as the “Zycode” phishing campaign. At FireEye Labs we have an automated system designed to proactively detect newly...

Rotten Apples: Resurgence

In June 2016, we published a blog about a phishing campaign targeting the Apple IDs and passwords of Chinese Apple users that emerged in the first quarter of 2016 referred to as the “Zycode” phishing campaign. At FireEye Labs we have an automated system designed to proactively detect newly...

IBM Security Guardium Cross-Site Scripting Vulnerability

IBM Security Guardium is a data activity monitor product from IBM USA. The product offers features such as automated controls for compliance and protection against internal and external threats. A cross-site scripting vulnerability exists in IBM Security Guardium. A remote attacker could exploit...

UBUNTU-CVE-2016-7046

Red Hat JBoss Enterprise Application Platform EAP 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers to cause a denial of service CPU and disk consumption via a long URL...

baserCMS plugin Blog vulnerable to cross-site request forgery

Overview baserCMS provided by baserCMS User Group is an opensource content management system. baserCMS and bundled plugin Blog contain a cross-site request forgery vulnerability. Isao Takaesu of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with t...

ASUS RT-N10E URL Redirection Vulnerability

ASUS RT-N10E Wireless Router is a wireless router device developed by ASUS. A URL redirection vulnerability exists in ASUS RT-N10E. Allowing an attacker can exploit the vulnerability to conduct redirection attacks...

plone reflective cross-site scripting vulnerability (CNVD-2016-07280)

Plone is a free, open source Content Management System CMS. Plone's URL detection architecture includes a way to detect if the URL is valid and located in plone's site. XSS can be achieved by passing js into a specially crafted url...

Cisco Hosted Collaboration Mediation Fulfillment Directory Traversal Vulnerability (CNVD-2016-07110)

Cisco Hosted Collaboration Solution HCS is a cloud service that provides communication and collaboration solutions. A security vulnerability exists in the web interface of Cisco Hosted Collaboration Mediation Fulfillment. Due to the program not properly validating the HTTP URL format. An...

chromium-browser: Parameter sanitization failure in DevTools

The Developer Tools aka DevTools subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different...

UBUNTU-CVE-2016-5143

The Developer Tools aka DevTools subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different...

SQL Injection Vulnerability in the Remote Consultation System of Beijing Blue Weather Technology Co.

BlueWell is a high-tech enterprise specializing in providing telemedicine services, and has constructed a nationwide telemedicine service platform, realizing a system platform for teleconsultation, specialist diagnosis, remote monitoring, surgical demonstration, two-way referral, remote education...

chromium-browser: url leakage via pac script

net/proxy/proxyservice.cc in the Proxy Auto-Config PAC feature in Google Chrome before 52.0.2743.82 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, a related issue to...

Google Chrome URL Forgery Vulnerability

Google Chrome is a web browser developed by the American company Google Google. A URL forgery vulnerability exists in the file ios/web/webstate/ui/crwwebcontroller.mm in versions of Google Chrome prior to 52.0.2743.82 on the iOS platform, which stems from a failure to verify that invalid URLs are...

CVE-2016-5134

net/proxy/proxyservice.cc in the Proxy Auto-Config PAC feature in Google Chrome before 52.0.2743.82 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, a related issue to...

CVE-2016-1707

ios/web/webstate/ui/crwwebcontroller.mm in Google Chrome before 52.0.2743.82 on iOS does not ensure that an invalid URL is replaced with the about:blank URL, which allows remote attackers to spoof the URL display via a crafted web site...

UBUNTU-CVE-2016-5130

content/renderer/historycontroller.cc in Google Chrome before 52.0.2743.82 does not properly restrict multiple uses of a JavaScript forward method, which allows remote attackers to spoof the URL display via a crafted web site...

The vulnerability of the Apache Struts software platform, which allows a hacker to trigger a service failure

The vulnerability of the URLValidator class in the Apache Struts software framework exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to cause a service failure by using a null value in the URL field...