2100 matches found
Authorization
An issue was discovered in WPO-Foundation WebPageTest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "webpagetest-master/www/compare-cf.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerabl...
Authorization
An issue was discovered in whatanime.ga before c334dd8499a681587dd4199e90b0aa0eba814c1d. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "whatanime.ga-master/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the...
Ubuntu 16.04 LTS : WebKitGTK+ vulnerabilities (USN-3200-1)
The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3200-1 advisory. A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, ...
USN-3200-1: WebKitGTK+ vulnerabilities
A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service...
Authorization
An issue was discovered in caddy for TYPO3 before 7.2.10. The vulnerability exists due to insufficient filtration of user-supplied data in the "paymillToken" HTTP POST parameter passed to the "caddy/Resources/Public/JavaScript/e-payment/paymill/api/php/payment.php" URL. An attacker could execute...
CVE-2017-5963
An issue was discovered in caddy for TYPO3 before 7.2.10. The vulnerability exists due to insufficient filtration of user-supplied data in the “paymillToken” HTTP POST parameter passed to the “caddy/Resources/Public/JavaScript/e-payment/paymill/api/php/payment.php” URL. An attacker could execute...
Ubuntu 16.04 LTS : WebKitGTK+ vulnerabilities (USN-3191-1)
The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3191-1 advisory. A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, ...
USN-3191-1 webkit2gtk vulnerabilities
A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service...
USN-3191-1: WebKitGTK+ vulnerabilities
A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service...
Google Chrome - HTMLKeygenElement::shadowSelect() Type Confusion
Google Chrome - HTMLKeygenElement::shadowSelect Type Confusion var range = document.caretRangeFromPoint50, 50; var shadowtreecontainer = range.commonAncestorContainer; shadowtreecontainer.prepend"foo"; keygenelement.disabled = true;...
Informatica: [marketplace.informatica.com] Search XSS
The search query parameter is put into Javascript to set the localStorage item: https://marketplace.informatica.com/search-solr.jspa?q=%foo% javascript localStorage.setItem"searchTerm", "%foo%"; Attempts to inject XSS payloads are blocked by redirection that removes special chars from the URL: ht...
Microsoft Edge - JSON.parse Info Leak
Microsoft Edge - JSON.parse Info Leak var once = false; var a = 1; function f if!once a = new Array1, 2, 3; this2 = a; once = true; //alert"f " + this; return ; JSON.parse"1, 2, 4, 5", f; var n = new Numbera0; n = n 1; var s = n.toString16; n = new Numbera1; n = n 1; s = s + n.toString16; n.lengt...
Microsoft Internet Explorer 10 MSHTML CEditAdorner::Detach Use-After-Free
Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the nineteenth entry in that series. Unfortunately I won't be able to publish everything within one month at the current rate, so I may continue to publish these throu...
Microsoft SQL Server Master Data Services CVE-2016-7251 Cross Site Scripting Vulnerability
Description Microsoft SQL Server is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. Technologie...
Microsoft Edge and Internet Explorer XSS Filter CVE-2016-7239 Information Disclosure Vulnerability
Description Microsoft Edge and Internet Explorer are prone to an information-disclosure vulnerability that affects the XSS Filter. An attacker can exploit this issue by tricking an unsuspecting victim into viewing a page containing malicious content. An attacker can exploit this issue to execute...
2345 browser 8. 1. 0. 13750 arbitrary local file reading
No description provided by source...
Scripting Engine Memory Corruption Vulnerability
A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. In a web-based...
Online Hotel Booking System Pro 1.2 Cross Site Scripting
======================================================================== | Title : Online Hotel Booking System Pro v1.2 XSS vulnerability | Author : indoushka | email : [email protected] | Tested on : windows 8.1 FranASSais V.Pro | Version : v1.2 | Vendor :...
Microsoft Exchange Server CVE-2016-3378 Open Redirection Vulnerability
Description Microsoft .NET Framework is prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input. An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may ...
The vulnerability of the Firefox browser, which allows a hacker to replace the address bar
The vulnerability of Firefox browsers exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to substitute the URL field using special characters in the data:URL format...