CVE-2014-3201

core/rendering/compositing/RenderLayerCompositor.cpp in Blink, as used in Google Chrome before 38.0.2125.102 on Android, does not properly handle a certain IFRAME overflow condition, which allows remote attackers to spoof content via a crafted web site that interferes with the scrollbar...

skywcm v3.1 /skywcm/webpage/download.jsp 任意文件下载漏洞

No description provided by source...

Stack overflow

Stack-based buffer overflow in the diagnose service in the Sophos Cyberoam appliances with CyberoamOS before 10.6.1 GA allows remote attackers to execute arbitrary code via a crafted webpage or file...

Oracle Java AtomicReferenceFieldUpdater Type Confusion (CVE-2014-4262)

A memory corruption vulnerability exists in Oracle Java. The vulnerability is due to a type confusion flaw in AtomicReferenceFieldUpdater class. A remote unauthenticated attacker can exploit this vulnerability by enticing a user to visit a webpage containing maliciously crafted Java applet...

Phabricator: Content Spoofing through URL

Hello I hope this is upto the level you guys think of accepting reports. Specified content can be injected into the webpage as text using the URL Consider this...

Oracle Java System.arraycopy Race Condition (CVE-2014-0456)

A code execution vulnerability has been reported in Oracle Java. The vulnerability is due to a race condition in System.arraycopy. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to visit a webpage containing a maliciously crafted Java applet...

Oracle Java Generic Signature Attribute Memory Corruption (CVE-2014-4216)

A memory corruption vulnerability exists in Oracle Java. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to visit a webpage containing a maliciously crafted Java applet. Successful exploitation could result in arbitrary code execution...

Assessing risk for the September 2014 security updates

Today we released four security bulletins addressing 42 unique CVE’s. One bulletin has a maximum severity rating of Critical and the other three have maximum severity Important. This table is designed to help you prioritize the deployment of updates appropriately for your environment. Bulletin Mo...

Microsoft Internet Explorer CVE-2014-4088 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in...

Microsoft July 2014 Patch Tuesday fixes 29 IE Vulnerabilities

Microsoft today issued two critical-, three important-, and one moderate-rated security bulletins in the July edition of its monthly Patch Tuesday release. The updates address 29 security vulnerabilities in the company’s Windows operating system, Internet Explorer browser, and server software. Th...

Internet Explorer 4.1/5.0/4.0.1 Subframe Spoofing Vulnerability

No description provided by source. Internet Explorer 4.1 for Windows 95/Windows 98/Windows NT 4,Internet Explorer 5.0 for Windows 95/Windows 98/Windows NT 4,Internet Explorer 4.0.1 for Windows 98/Windows NT 4.0 Subframe Spoofing Vulnerability source: http://www.securityfocus.com/bid/855/info IE's...

MS IE 4.0/5.0 ActiveX "Eyedog" Vulnerability

No description provided by source. Microsoft Internet Explorer 4.0/5.0 for Windows 95/Windows NT 4/Windows 2000/Windows 95/Windows 98 ActiveX Eyedog Vulnerability source: http://www.securityfocus.com/bid/619/info The Eyedog ActiveX control is marked 'safe for scripting' although it permits regist...

Compaq Java Applet for Presario SpawnApp Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/557/info Some Compaq computers come with a Java applet called SpawnApp. This applet is used to run Compaq diagnostic utilities from the local hard drive when certain Compaq websites are viewed. The problem is that the...

Mewsoft NetAuction 3.0 Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5023/info NetAuction does not filter HTML code from URI parameters, making it prone to cross-site scripting attacks. Attacker-supplied HTML code may be included in a malicious links. The attacker-supplied HTML code will b...

Mozilla Firefox <= 3.5.3 Floating Point Conversion Heap Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/36851/info Mozilla Firefox is prone to a heap-based buffer-overflow vulnerability. An attacker can exploit this issue by tricking a victim into visiting a malicious webpage to execute arbitrary code and to cause...

Netscape Communicator 4.06/4.5/4.6/4.51/4.61 EMBED Buffer Overflow Vulnerability

No description provided by source. / source: http://www.securityfocus.com/bid/618/info In several versions of Netscape Communicator, there is an unchecked buffer in the code that handles EMBED tags. The buffer is in the 'plugins page' option. This vulnerability can be exploited by a malicious...

Microsoft Internet Explorer 5/6 XML Redirect File Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5560/info A flaw in Microsoft Internet Explorer may reveal the entire contents of XML files and partial contents of other files to attackers. This vulnerability allows an attacker to read the entire contents of XML files,...

Apple Quicktime < 7.2 - SMIL Remote Integer Overflow PoC

No description provided by source. ---------------------------------------------------------------------- ATTACK VECTORS ---------------------------------------------------------------------- This vulnerability can be triggered by luring a target user into running a malicious SMIL file locally or...

Symantec Messaging Gateway 9.5.3-3 CSRF Vulnerability

No description provided by source. ======= Summary ======= Name: Symantec Messaging Gateway - Easy CSRF to add a backdoor-administrator for example Release Date: 30 November 2012 Reference: NGS00263 Discoverer: Ben Williams [email protected] Vendor: Symantec Vendor Reference: Systems...

McAfee Network Security Manager < 5.1.11.8.1 - Information Disclosure Vulnerability

No description provided by source. To exploit this issue, an attacker must entice an unsuspecting user to view a malicious webpage. The following proof of concept uses a cross-site scripting attack to leverage this issue:...