WordPress 2.8-4.7 - Accessibility Mode Cross-Site Request Forgery (CSRF)

...

Apple iOS < 10.2 Multiple Vulnerabilities

Binary data 9847.prm...

Apple iOS < 10.2 Multiple Vulnerabilities

Binary data appleios102check.nbin...

About the security content of iOS 10.2

About the security content of iOS 10.2 This document describes the security content of iOS 10.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recen...

Trello: SVG Uploads / Attachments can be viewed by anyone that knows the URL

1 Login 2 Create a new private board 3 Upload the SVG file attached 4 Grab the file URL 5 Open a new incognito window and navigate to the URL. Note that you were able to access the SVG file as well as that the script payload executed...

Google Chrome Accessibility blink::Node Corruption Exploit

A specially crafted web-page can trigger an unknown memory corruption vulnerability in Google Chrome Accessibility code. An attacker can cause code to attempt to execute a method of an object using a vftable, when the pointer to that object is not valid, or the object is not of the expected type...

Google Chrome Accessibility blink::Node Corruption

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the twenty-first entry in that series. Unfortunately I won't be able to publish everything within one month at the current rate, so I may continue to publish these...

Pushwoosh: htaccess file is accesible

Design Issue, Information Disclosure, Low Severity. Non-critical , a little information disclosure...

USN-3112-1 thunderbird vulnerabilities

Catalin Dumitru discovered that URLs of resources loaded after a navigation start could be leaked to the following page via the Resource Timing API. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to obtain sensiti...

PT-2016-2981 · Adobe +3 · Flash Player +3

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions prior to 18.0.0.382 Adobe Flash Player versions 19.x through 23.x before 23.0.0.185 Adobe Flash Player version 11.2.202.637 and earlier on Linux Description: The issue is related to a use-after-free vulnerability i...

Adobe Flash Accessibility sendEvent Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within Accessibility's...

CVE-2016-3923

The Accessibility services in Android 7.0 before 2016-10-01 mishandle motion events, which allows attackers to conduct touchjacking attacks and consequently gain privileges via a crafted application, aka internal bug 30647115...

CVE-2016-3923

The Accessibility services in Android 7.0 before 2016-10-01 mishandle motion events, which allows attackers to conduct touchjacking attacks and consequently gain privileges via a crafted application, aka internal bug 30647115...

CVE-2016-3923

The Accessibility services in Android 7.0 before 2016-10-01 mishandle motion events, which allows attackers to conduct touchjacking attacks and consequently gain privileges via a crafted application, aka internal bug 30647115...

Code injection

The Accessibility services in Android 7.0 before 2016-10-01 mishandle motion events, which allows attackers to conduct touchjacking attacks and consequently gain privileges via a crafted application, aka internal bug 30647115...

UBUNTU-CVE-2016-3923

The Accessibility services in Android 7.0 before 2016-10-01 mishandle motion events, which allows attackers to conduct touchjacking attacks and consequently gain privileges via a crafted application, aka internal bug 30647115...

CVE-2016-3923

The Accessibility services in Android 7.0 before 2016-10-01 mishandle motion events, which allows attackers to conduct touchjacking attacks and consequently gain privileges via a crafted application, aka internal bug 30647115...

CVE-2016-3923

CVE-2016-3923 : A vulnerability in Android 7.0’s Accessibility services (mishandling motion events) could allow a local, crafted application to perform touchjacking and gain privileges. Affected: Android 7.0 up to the 2016-10-01 patch level (with fixes addressed in the Android 2016-10-01/2016-10-...

Mozilla Firefox and Firefox ESR 'mozilla::a11y::DocAccessible::ProcessInvalidationListk' function memory misreference vulnerability

Mozilla Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. A memory misreference vulnerability exists in the Mozilla Firefox and Firefox ESR 'mozilla::a11y::DocAccessible::ProcessInvalidationListk' function, which allows remote attackers to exploit the...

Ubuntu: Security Advisory (USN-3076-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...