JVN#56588965: Cybozu KUNAI for Android vulnerable to cross-site scripting

Cybozu KUNAI for Android is mobile client software for using Cybozu from an Android device. Cybozu KUNAI for Android contains a cross-site scripting vulnerability CWE-79 due to an issue in mobile view mode. Impact An arbitrary script may be executed on the user's web browser. Solution Update the...

Easy File Sharing Web Server 7.2 - 'POST' Remote Buffer Overflow

!/usr/bin/python Title : EFS Web Server 7.2 POST HTTP Request Buffer Overflow Author : Touhid M.Shaikh Date : 12 June, 2017 Contact: [email protected] Version: 7.2 category: Remote Exploit Tested on: Windows XP SP3 EN Version 5.1.2600 """ Description What is Easy File Sharing Web Server 7....

Easy File Sharing Web Server 7.2 - Authentication Bypass

Easy File Sharing Web Server 7.2 - Authentication Bypass Exploit Title: EFS Web Server 7.2 Authentication Bypass Date: 11-06-2017 Software Link: http://www.sharing-file.com/efssetup.exe Software Version : 7.2 Exploit Author: Touhid M.Shaikh Contact: http://twitter.com/touhidshaikh22 Website:...

Easy File Sharing Web Server 7.2 - Authentication Bypass

Exploit Title: EFS Web Server 7.2 Authentication Bypass Date: 11-06-2017 Software Link: http://www.sharing-file.com/efssetup.exe Software Version : 7.2 Exploit Author: Touhid M.Shaikh Contact: http://twitter.com/touhidshaikh22 Website: http://touhidshaikh.com/ Description Video PoC and Article...

[SECURITY] Fedora 26 Update: chromium-58.0.3029.110-2.fc26

Chromium is an open-source web browser, powered by WebKit Blink...

Lightning Web Browser - Customized SSL, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Lightning Web Browser published at the 'play' market has multiple vulnerabilities...

Ubuntu 16.04 LTS : WebKitGTK+ vulnerabilities (USN-3303-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3303-1 advisory. A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, ...

Ubuntu: Security Advisory (USN-3303-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3303-1: WebKitGTK+ vulnerabilities

A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service...

Apple iOS and Safari WebKit Memory Corruption Vulnerability (CNVD-2017-07606)

Apple iOS and Safari are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices; Safari is a web browser that is the default browser that comes with Mac OS X and iOS operating systems; WebKit is an open-source web browser engine developed by KDE, Apple, Google,...

Mozilla Firefox 'UnbindFromTree' Stack Buffer Overflow Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. Mozilla Firefox suffers from a stack buffer overflow vulnerability. An attacker could exploit this vulnerability to cause the affected application to crash, resulting in a denial of service...

[SECURITY] Fedora 25 Update: chromium-58.0.3029.110-2.fc25

Chromium is an open-source web browser, powered by WebKit Blink...

CVE-2017-2162

FlashAirTM SDHC Memory Card SD-WE Series V3.00.02 and earlier and FlashAirTM SDHC Memory Card SD-WD/WC Series V2.00.04 and earlier allows default credentials to be set for wireless LAN connections to the product when enabling the PhotoShare function through a web browser...

The CIS Critical Controls Explained - Control 7: Email and Web browser protection

This blog is a continuation of our blog post series around the CIS Critical Controls. The biggest threat surface in any organization is its workstations. This is the reason so many of the CIS Critical Security Controls relate to workstation and user-focused endpoint security. It is also the reaso...

WordPress BestWebSoft Captcha Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation a set of blogging platform developed using the PHP language, the platform supports in PHP and MySQL servers to set up a personal blog site.BestWebSoft Captcha is one of the website back-end CAPTCHA plugin. A cross-site scripting vulnerability exists ...

Tenable Network Security Nessus Cross-Site Scripting Vulnerability

Tenable Network Security Nessus is a highly scalable open source vulnerability scanner from Tenable Network Security, USA. A cross-site scripting vulnerability exists in Tenable Network Security Nessus. A remote attacker can exploit this vulnerability to execute arbitrary avaScript in the current...

Shadow Brokers, Who Leaked WannaCry SMB Exploit, Are Back With More 0-Days

The infamous hacking collective Shadow Brokers – the one who leaked the Windows SMB exploit in public that led to last weekend's WannaCrypt menace – are back, this time, to cause more damage. In typically broken English, the Shadow Brokers published a fresh statement with full of frustration a fe...

CVE-2017-8936

The MoboTap Dolphin Web Browser - Fast Private Internet Search app 9.23.0 through 9.23.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The MoboTap Dolphin Web Browser - Fast Private Internet Search app 9.23.0 through 9.23.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-8936

The CVE-2017-8936 entry concerns the MoboTap Dolphin Web Browser (iOS) versions 9.23.0 through 9.23.2. The vulnerability is that the app does not verify X.509 certificates from SSL servers, which can allow a man-in-the-middle attacker to spoof a server and obtain sensitive information via a craft...