Cross-Site Scripting: The Real WordPress Supervillain

Vulnerabilities are a fact of life for anyone managing a website, even when using a well-established content management system like WordPress. Not all vulnerabilities are equal, with some allowing access to sensitive data that would normally be hidden from public view, while others could allow a...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input (CVE-2016-0399)

Summary IBM Maximo Asset Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using the a specially-crafted URL to execute script in a victim's Web browser within the security context of the...

Security Bulletin: Cross-Site Scripting Security Vulnerability in IBM Maximo Asset Management (CVE-2015-4944)

Summary A cross-site scripting vulnerability in Maximo Asset Management could allow an attacker to execute script in a victim's Web browser, within the security context of the hosting Web site. The vulnerability affects Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry...

Mozilla Firefox Resource Management Error Vulnerability (CNVD-2023-06859)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a memory misreference vulnerability that stems from concurrent use of the URL parser for non-UTF-8 data not being thread-safe. An attacker could exploit the vulnerability t...

USN-5611-1: WebKitGTK vulnerability

Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and...

Adobe Experience Manager 跨站脚本漏洞

Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications and forms. Adobe Experience Manager contains a cross-site scripting vulnerability that could be exploited by attackers to execute malicious JavaScript content in the...

Cross site scripting

SAP NetWeaver Enterprise Portal KMC - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could compromise the...

CVE-2022-35298

SAP NetWeaver Enterprise Portal KMC - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could compromise the...

CVE-2022-35298: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Enterprise Portal KMC - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could compromise the...

Threat Source newsletter (Sept. 8, 2022) — Why there is no one-stop-shop solution for protecting passwords

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. It seems like there’s at least one major password breach every month — if not more. Most recently, there was an incident at Plex where all users had to reset their passwords. Many users pay for a password management...

Google Releases Urgent Chrome Update to Patch New Zero-Day Vulnerability

Google on Friday shipped emergency fixes to address a security vulnerability in the Chrome web browser that it said is being actively exploited in the wild. The issue, assigned the identifier CVE-2022-3075, concerns a case of insufficient data validation in Mojo, which refers to a collection of...

Google Chrome 输入验证错误漏洞

Google Chrome is a web browser from Google, Inc. in the United States. Google Chrome has a security vulnerability that stems from insufficient data validation in Mojo...

Microsoft Edge (Chromium) < 105.0.1343.27 Vulnerability

The version of Microsoft Edge installed on the remote Windows host is prior to 105.0.1343.27. It is, therefore, affected by a vulnerability as referenced in the September 2, 2022 advisory. - Insufficient data validation in Mojo. CVE-2022-3075 Note that Nessus has not tested for this issue but has...

firefox security update

CentOS Errata and Security Advisory CESA-2022:6179 An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Google Chrome WebSQL Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in versions of Google Chrome prior to 105.0.5195.52, which stems from a mix-up in instructions responsible for freeing memory in WebSQL. An attacker could exploit this vulnerability to...

Google Chrome SplitScreen Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in versions of Google Chrome prior to 105.0.5195.52, which stems from a mix-up in the instruction responsible for freeing memory in SplitScreen. An attacker could exploit this vulnerability...

Google Chrome Layout Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in versions of Google Chrome prior to 105.0.5195.52, which stems from a mix-up in instructions responsible for freeing memory in Layout. An attacker could exploit this vulnerability to...

Google Chrome Browser Tag Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in versions prior to Google Chrome 105.0.5195.52, which can be exploited by an attacker to trick users into installing malicious extensions, which may lead to heap corruption via a crafted...

CVE-2022-2485

Any attempt good or bad to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its password in the communication packets...

CVE-2022-2485 AutomationDirect Stride Field I/O Cleartext Transmission of Sensitive Information

Any attempt good or bad to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its password in the communication packets...