PT-2014-1170

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 28.0 Firefox ESR 24.x versions prior to 24.4 Thunderbird versions prior to 24.4 SeaMonkey versions prior to 2.25 Description The Web IDL implementation in the affected software allows remote attackers to execu...

Slack: Stored XSS

Hi, Go to this URL https://sehacure.slack.com/account/preferences?updatedhighlightwords=1 and in the highlight words option please fill the XSS vector as promptdocument.cookie; Your cookie will be reflected. Best regards, Anand...

CVE-2014-1887

The DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain sensitive fine-geolocation information, by leveraging control over one of a number of adult sites, as demonstrated b...

CVE-2014-1885

The ForzeArmate application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain write access to external-storage resources, by leveraging control over any Google syndication advertising domain...

Design/Logic Flaw

The DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain sensitive fine-geolocation information, by leveraging control over one of a number of adult sites, as demonstrated b...

CVE-2014-1886

The Edinburgh by Bus application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently access external-storage resources, by leveraging control over one of a number of "obscure Eastern European dating sites."...

CVE-2014-1887

The DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain sensitive fine-geolocation information, by leveraging control over one of a number of adult sites, as demonstrated b...

CVE-2014-1885

The ForzeArmate application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain write access to external-storage resources, by leveraging control over any Google syndication advertising domain...

PT-2014-4343

Name of the Vulnerable Software and Affected Versions Edinburgh by Bus application for Android versions using Adobe PhoneGap 2.9.0 or earlier Description The issue allows remote attackers to execute arbitrary JavaScript code and access external-storage resources by leveraging control over certain...

PT-2014-4342

Name of the Vulnerable Software and Affected Versions ForzeArmate application for Android versions with Adobe PhoneGap 2.9.0 or earlier Description The issue allows remote attackers to execute arbitrary JavaScript code and obtain write access to external-storage resources by leveraging control ov...

CVE-2014-1887: Undefined Security Weakness

The DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain sensitive fine-geolocation information, by leveraging control over one of a number of adult sites, as demonstrated b...

PT-2014-4344

Name of the Vulnerable Software and Affected Versions DrinkedIn BarFinder application for Android versions with Adobe PhoneGap 2.9.0 or earlier Description The issue allows remote attackers to execute arbitrary JavaScript code and obtain sensitive fine-geolocation information by leveraging contro...

PT-2014-1992

Name of the Vulnerable Software and Affected Versions Apache Cordova In-App-Browser standalone plugin versions prior to 0.3.2 In-App-Browser plugin for iOS from Cordova versions 2.6.0 through 2.9.0 Description The issue is related to the CDVInAppBrowser class, which does not properly validate...

Cisco MARS Cross Site Scripting

Vulnerability Type: Cross-Site Scripting CVE: CVE-2013-5563 Products and affected versions: Cisco Security Monitoring, Analysis and Response System CS-MARS - All versions Vendor Website: http://www.cisco.com/en/US/products/ps6241/ Cisco Advisory: https://tools.cisco.com/bugsearch/bug/CSCul16173...

CVE-2013-5598: Undefined Security Weakness

PDF.js in Mozilla Firefox before 25.0 and Firefox ESR 24.x before 24.1 does not properly handle the appending of an IFRAME element, which allows remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges by using this element within an embedded PDF object...

PT-2013-5668

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 25.0 Mozilla Firefox ESR versions 24.x prior to 24.1 Description The issue allows remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges by using an IFRAME element...

CVE-2013-5703

The DrayTek Vigor 2700 router 2.8.3 allows remote attackers to execute arbitrary JavaScript code, and modify settings or the DNS cache, via a crafted SSID value that is not properly handled during insertion into the sWlessSurvey value in variables.js...

Code injection

The DrayTek Vigor 2700 router 2.8.3 allows remote attackers to execute arbitrary JavaScript code, and modify settings or the DNS cache, via a crafted SSID value that is not properly handled during insertion into the sWlessSurvey value in variables.js...

PT-2013-5738

Name of the Vulnerable Software and Affected Versions DrayTek Vigor 2700 router version 2.8.3 Description The issue allows remote attackers to execute arbitrary JavaScript code and modify settings or the DNS cache. This is achieved by using a crafted SSID value that is not properly handled during...

CVE-2013-5703: Improper Neutralization of Special Elements used in an OS Command

The DrayTek Vigor 2700 router 2.8.3 allows remote attackers to execute arbitrary JavaScript code, and modify settings or the DNS cache, via a crafted SSID value that is not properly handled during insertion into the sWlessSurvey value in variables.js...