CVE-2016-9757

In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags can inject cross-site scripting XSS elements in the tag name field. Once this tag is viewed in the Tag Detail page of the Rapid7 Nexpose 6.4.12 UI by another...

IBM Kenexa LMS on Cloud Cross-Site Scripting Vulnerability

IBM Kenexa LMS on Cloud is a full-featured, configurable, enterprise-grade, social Learning Management System LMS that integrates social networking, collaboration, and knowledge sharing capabilities. The software provides interactive elements that support users in evaluating learning content and...

UBUNTU-CVE-2016-1586

A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for destruction in versions of Oxide before 1.18.3...

Google Chrome Internals Memory Misreference Vulnerability

Google Chrome is a popular web browser. Google Chrome suffers from a memory misreference vulnerability. An attacker can exploit the vulnerability to execute arbitrary code in the context of the browser or cause a denial of service condition...

Google Chrome Extension Script Injection Vulnerability (CNVD-2016-07203)

Google Chrome is a web browser developed by the American company Google Google. A script injection vulnerability exists in versions of Google Chrome Extensions prior to 53.0.2785.89. An attacker can exploit this vulnerability to execute arbitrary code in the browser context...

Google Chrome Script Injection Vulnerability

Google Chrome is a web browser developed by the American company Google Google. A script injection vulnerability exists in versions of Google Chrome prior to 53.0.2785.89. An attacker can exploit this vulnerability to execute arbitrary code in the browser context to bypass security restrictions,...

Google Chrome memory misreference vulnerability (CNVD-2016-07205)

Google Chrome is a web browser developed by the American company Google Google. A memory misreference vulnerability exists in event binding in Google Chrome versions prior to 53.0.2785.89. An attacker can exploit this vulnerability to execute arbitrary code in the browser context to bypass securi...

ASUS DSL-N55U Router Cross-Site Scripting Vulnerability

ASUS DSL-N55U is a dual-band wireless router product from ASUS. Cross-site scripting vulnerabilities exist in ASUS DSL-N55U Router version 3.0.0.4.3762736 that stem from the program failing to properly filter user-submitted input. An attacker could execute arbitrary code in the context of the...

openSUSE Security Update : Mozilla Thunderbird (openSUSE-2016-851)

This update contains Mozilla Thunderbird 45.2. boo983549 It fixes security issues mostly affecting the e-mail program when used in a browser context, such as viewing a web page or HTMl formatted e-mail. The following vulnerabilities were fixed : - CVE-2016-2818, CVE-2016-2815: Memory safety bugs...

The vulnerability of Juniper SRX 240 microprogramming software allows a hacker to execute arbitrary Java scripts in the context of the user’s browser.

The Juniper SRX 240 router software contains a vulnerability in the index.php module, allowing an attacker to execute arbitrary Java scripts in the user’s browser context due to insufficient filtering of service-specific symbols...

Visual Paradigm Server 10.0 Cross Site Scripting Vulnerability

Visual Paradigm Server version 10.0 suffers from a cross site scripting vulnerability. ================================================================ Visual Paradigm Server v10.0 - Cross Site Scripting XSS ================================================================ Information...

Visual Paradigm Server 10.0 Cross Site Scripting

================================================================ Visual Paradigm Server v10.0 - Cross Site Scripting XSS ================================================================ Information -------------------- Name: Visual Paradigm Server v10.0 - Cross Site Scripting XSS Affected Softwar...

SolarWinds DameWare Mini Remote Control URI Handler Stack Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SolarWinds DameWare Mini Remote Control. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

D-Link DCS-2103 HTML Injection Vulnerability

D-link DCS-2103 is a network camera product from AUO D-Link. An HTML injection vulnerability exists in the D-Link DCS-2103. A remote attacker can exploit this vulnerability to execute arbitrary HTML code in a browser context...

Reflected Cross-Site Scripting (XSS) in iTop

High-Tech Bridge Security Research Lab discovered vulnerability in iTop, which can be exploited to perform Cross-Site Scripting XSS attacks against web application users. iTop is a critical application, which is used to cover the entire set of ITIL processes. Successful attack on this web...

Cross-Site Scripting (XSS) in qTranslate WordPress Plugin

High-Tech Bridge Security Research Lab discovered vulnerability in qTranslate WordPress plugin, which can be exploited to perform Cross-Site Scripting XSS attacks against website administrators. Successful exploitation of this vulnerability may allow a remote attacker to gain complete control ove...

DIY CMS 1.0 Poll - Multiple Vulnerabilities (CVE-2012-6518)

Multiple web vulnerabilities were discovered in DIY v1.0 Content Management System. The vulnerabilities are due to improper input validation within several methods. Successful exploitation of these vulnerabilities may allow an attacker to execute arbitrary SQL commands which can result in the...

Unspecified Cross-Site Scripting Vulnerability in Multiple Websense Products

Websense, Inc. NASDAQ: WBSN is the world's leading provider of integrated Web, information and data security protection solutions. An unspecified cross-site scripting vulnerability exists in multiple Websense products due to the program failing to properly filter user-supplied input. The...

JSONP Callback Attack

Overview Affected versions of this package are vulnerable to JSONP Callback Attack. JSONP JSON with padding is a method used to request data from a server residing in a different domain than the client. Any url could perform JSONP requests, allowing full access to the browser and the JavaScript...

(0Day) WebGate eDVR Manager WESPSerialPort.WESPSerialPortCtrl.1 Connect Method Stack Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of WebGate eDVR Manager. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...