1011 matches found
WebKit Patch #1110 Universal Cross Site Scripting
WebKit: UXSS: the patch of 1110 made another bug Here's the patch of 1110. https://trac.webkit.org/changeset/212218/trunk/Source/WebCore/dom/ContainerNode.cpp void ContainerNode::parserRemoveChildNode& oldChild disconnectSubframesIfNeededthis, DescendantsOnly; d = document.querySelector'div'; p =...
WebKit - 'enqueuePageshowEvent' / 'enqueuePopstateEvent' Universal Cross-Site Scripting
view-frame.page; frame.tree.appendChildchildFrame-view-frame; childFrame-open; enqueuePageshowEventPageshowEventPersisted; HistoryItem historyItem = frame.loader.history.currentItem; if historyItem && historyItem-stateObject mdocument-enqueuePopstateEventhistoryItem-stateObject;...
ImageMagick Denial of Service Vulnerability (CNVD-2017-07524)
ImageMagick is a set of open-source image processing software from the U.S. company ImageMagick Studio. The software can read, convert and write pictures in a variety of formats. A denial-of-service vulnerability vulnerability exists in the 'WriteBlob' function of the MagickCore/blob.c file in...
DEBIAN-CVE-2017-9142
In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the WriteBlob function in MagickCore/blob.c because of missing checks in the ReadOneJNGImage function in coders/png.c...
UBUNTU-CVE-2017-9142
In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the WriteBlob function in MagickCore/blob.c because of missing checks in the ReadOneJNGImage function in coders/png.c...
CVE-2017-3545
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware subcomponent: Blob Server. Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP ...
CVE-2017-3545
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware subcomponent: Blob Server. Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP ...
CVE-2017-3545
Vulnerability CVE-2017-3545 affects Oracle WebCenter Sites (Fusion Middleware) subcomponent Blob Server. Affected versions: 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0, 12.2.1.2.0. The issue allows an unauthenticated attacker with network access over HTTP to compromise the system, enabling unauthorized cr...
Mozilla Firefox - Address Bar Spoofing
Mozilla Firefox - Address Bar Spoofing location=URL.createObjectURLnew Blob'Not Googleiflocation.href.indexOf"google"==-1location.pathname="https://www.google.com/"elsedocument.title="Google Search"', type: 'text/html'...
Mozilla Firefox URL Spoofing Vulnerability
Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the U.S. Thunderbird is a mail tool adapted from the mail widget of the Mozilla browser. A URL spoofing vulnerability exists in Mozilla Firefox, where an attack can use a blob URL and a script to spoof arbitrary...
CVE-2017-5415
An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leading to user confusion and further spoofing attacks. This vulnerability affects Firefox 52...
UBUNTU-CVE-2017-5415
An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leading to user confusion and further spoofing attacks. This vulnerability affects Firefox 52...
DEBIAN-CVE-2016-7623
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive information via a blob URL on a web site...
Code injection
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive information via a blob URL on a web site...
CVE-2016-7623
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive information via a blob URL on a web site...
No Azure storage accounts can be found
Challenge When attempting to perform a direct restore to Azure through the Veeam Backup & Replication console, or via PowerShell Get-VBRAzureStorageAccount, no storage accounts can be found, or the specified storage account is not returned. Cause The storage accounts specified are blob storage...
MySQL File Uploader 1.0 SQL Injection
Exploit Title: MySQL Blob Uploader - File Upload to Database PHP Script v1.0 - SQL Injection Google Dork: N/A Date: 07.02.2017 Vendor Homepage: http://nelliwinne.net/ Software Buy: https://codecanyon.net/item/mysql-file-and-image-uploader-and-sharing-blob-file-server/17748300 Demo:...
MySQL File Uploader 1.0 - 'id' SQL Injection
Exploit Title: MySQL Blob Uploader - File Upload to Database PHP Script v1.0 - SQL Injection Google Dork: N/A Date: 07.02.2017 Vendor Homepage: http://nelliwinne.net/ Software Buy: https://codecanyon.net/item/mysql-file-and-image-uploader-and-sharing-blob-file-server/17748300 Demo:...
UBUNTU-CVE-2016-7623
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive information via a blob URL on a web site...
Design/Logic Flaw
Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted navigation to blob URLs with non-canonical origins, which allowed a remote attacker to spoof the contents of the Omnibox URL bar via crafted HTML pages...