Microsoft Office SharePoint CVE-2017-8654 Cross Site Scripting Vulnerability

Description Microsoft Office SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...

Ubuntu 16.04 LTS : WebKitGTK+ vulnerabilities (USN-3376-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3376-1 advisory. A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, ...

HackerOne: Content Security Policy not applied to error pages at multiple HackerOne endpoints

HackerOne CSP "script-src" includes "unsafe-inline" bypass via % and %" ----- Summary & Description We utilize a strict Content Security Policy and a safe-by-default templating language to effectively neutralize Cross-Site Scripting XSS. We encrypt all network communications with SSL/TLS...

Microsoft Edge CVE-2017-8611 Spoofing Vulnerability

Description Microsoft Edge is prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies Affected Microsoft Edge...

Microsoft Exchange Server CVE-2017-8621 Open Redirection Vulnerability

Description Microsoft .NET Framework is prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input. An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may ...

CVE-2016-1000220

Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers...

Microsoft SharePoint CVE-2017-8514 Cross Site Scripting Vulnerability

Description Microsoft SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may...

Microsoft SharePoint Server CVE-2017-8551 Remote Privilege Escalation Vulnerability

Description Microsoft SharePoint Server is prone to a remote privilege-escalation vulnerability because it fails to properly sanitize user-supplied input. An attackers may exploit this issue to gain elevated privileges. Successful exploits may aid in further attacks. Technologies Affected Microso...

CVE-2017-7667

Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin...

Code injection

The stock Android browser address bar in all Android operating systems suffers from Address Bar Spoofing, which allows remote attackers to trick a victim by displaying a malicious page for legitimate domain names...

Ubuntu 16.04 LTS : WebKitGTK+ vulnerabilities (USN-3303-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3303-1 advisory. A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, ...

The CIS Critical Controls Explained - Control 7: Email and Web browser protection

This blog is a continuation of our blog post series around the CIS Critical Controls. The biggest threat surface in any organization is its workstations. This is the reason so many of the CIS Critical Security Controls relate to workstation and user-focused endpoint security. It is also the reaso...

Mozilla Firefox 50 55 - Stack Overflow Denial of Service

Mozilla Firefox 50 55 - Stack Overflow Denial of Service function done var x = ''; for i=0; i'; var uri = 'data:image/svg+xml,' + x; var i = new Image; i.src = uri; !-- Visiting https://bugzilla.mozilla.org/attachment.cgi?id=8817075 may likely crash your browser tab. Debug Information:...

Microsoft Makes it Official, Cuts off SHA-1 Support in IE, Edge

Lost in yesterday’s shuffle of emergency updates and regularly scheduled monthly patches was Microsoft’s announcement that it was officially cutting off SHA-1 support in Internet Explorer 11 and Edge. Going forward, both browsers will block webpages signed with a SHA-1 TLS or SSL certificate from...

Microsoft SharePoint CVE-2017-0255 Cross Site Scripting Vulnerability

Description Microsoft SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may...

Microsoft Internet Explorer and Edge CVE-2017-0231 Spoofing Vulnerability

Description Microsoft Internet Explorer and Edge are prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies Affected...

Microsoft Internet Explorer CVE-2017-0064 Security Bypass Vulnerability

Description Microsoft Internet Explorer is prone to a security-bypass vulnerability. An attacker can exploit this issue by tricking an unsuspecting victim into viewing a page containing malicious content. This could allow the attacker to bypass certain security restrictions. This may lead to othe...

Google Chrome Networking Incorrect Signature Handling Vulnerability

Google Chrome is a web browser developed by Google Inc. in the United States. Google Chrome Networking incorrectly handles signatures, allowing remote attackers to exploit this vulnerability by submitting a special WEB page and tricking users into parsing it, which can be used in spoofing and...

Google Fixes Unicode Phishing Vulnerability in Chrome 58, Firefox Stands Pat

Google fixed a handful of issues when it released the latest version of its browser, Chrome 58, on Wednesday, including a vulnerability that could have made it easier for an attacker to carry out a phishing attack with Unicode domains. The vulnerability, based on Punycode – a way to represent...

For cross-browser local file disclosure vulnerability analysis-vulnerability warning-the black bar safety net

Foreword You know? You can easily turn ordinary file selector into a folder picker, to do this, simply drag the attribute“webkitdirectory”added to the type ='file'in the given input element on the line. Of course, with the folder selector is different, eventually you will load a given folder all...