2107 matches found
Microsoft Edge CVE-2015-6058 Cross Site Scripting Filter Security Bypass Vulnerability
Description Microsoft Edge is prone to a security-bypass vulnerability. Successful exploits will allow attackers to bypass the cross-site scripting filter and gain access to sensitive information; This may aid in further attacks. Technologies Affected Microsoft Edge Microsoft Windows 10 for 32-bi...
MGASA-2015-0389 Updated chromium-browser packages fix security vulnerabilities
Updated chromium-browser-stable packages fix security vulnerabilities: Two flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to bypass cross origin restrictions, and access or modify data from an unrelated web site...
Microsoft SharePoint CVE-2015-2522 HTML Injection Vulnerability
Description Microsoft SharePoint is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication...
Microsoft Skype for Business and Lync Server CVE-2015-2531 Cross Site Scripting Vulnerability
Description Microsoft Skype for Business and Microsoft Skype Lync Server are prone to a cross-site scripting vulnerability because they fail to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in...
Vulnerabilities Identified in Dolphin, Mercury Android Browsers
Vulnerabilities exist in two fairly popular alternative browsers for Android – Dolphin and Mercury — that depending on the browser could result in either remote code execution or arbitrary read/write access. Mobile security researcher Benjamin Watson, who blogs under the guise of Rotlogix...
Firefox 40 Begins Warning Users About Unsigned Add-Ons
With Tuesday’s release of Firefox 40, Mozilla has begun the process of requiring all add-ons for the browser to be signed. The company announced the forthcoming change in February, and Firefox 40 is the first version to warn users about unsigned add-ons. The goal for the change in policy is to...
Microsoft Windows UDDI Services CVE-2015-2475 Cross Site Scripting Vulnerability
Description Microsoft Windows UDDI Services is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site...
Microsoft XML Core Services CVE-2015-2440 Information Disclosure Vulnerability
Description Microsoft XML Core Services is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may lead to further attacks. Technologies Affected Microsoft InfoPath 2007 SP3 Microsoft Office 2007 SP2 Microsoft Office 20...
Microsoft XML Core Services CVE-2015-2471 Man in the Middle Information Disclosure Vulnerability
Description Microsoft XML Core Services is prone to an information-disclosure vulnerability. Attackers can exploit this issue to disclose potentially sensitive information through man-in-the-middle attacks. Technologies Affected Microsoft Office 2007 SP2 Microsoft Windows 7 for 32-bit Systems SP1...
Microsoft System Center Operations Manager CVE-2015-2420 Cross Site Scripting Vulnerability
Description Microsoft System Center Operations Manager is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the...
Microsoft XML Core Services CVE-2015-2434 Man in the Middle Information Disclosure Vulnerability
Description Microsoft XML Core Services is prone to an information-disclosure vulnerability. Attackers can exploit this issue to disclose potentially sensitive information through man-in-the-middle attacks. Technologies Affected Microsoft Office 2007 SP2 Microsoft Windows 7 for 32-bit Systems SP1...
Microsoft Internet Explorer CVE-2015-1729 Cross Domain Information Disclosure Vulnerability
Description Microsoft Internet Explorer is prone to a cross-domain information-disclosure vulnerability. An attacker can exploit this issue to view content from a browser window in another domain or security zone. This may allow the attacker to obtain sensitive information or aid in further...
Microsoft Internet Explorer CVE-2015-2419 JScript9 Remote Code Execution Vulnerability
Description Microsoft Internet Explorer is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks may cause denial-of-service conditions. Technologies Affected Avaya CallPilot 4.0...
Ad Fraud Malware Updating Flash on Infected PCs
Ad fraud malware is one of the more profitable specialties in the cybercrime world, and the attackers who use it often have to adapt their tactics in order to keep the money rolling in. One of the tactics that they have adopted in recent months is that of updating the version of Flash that’s...
IETF Officially Deprecates SSLv3
Attacks such as POODLE and BEAST not only caused some sleepless nights for server admins having to patch against the respective weaknesses, but they also accelerated SSLV3 deprecation. In the time since both attacks were disclosed, major browsers have removed the fallback condition that enabled t...
New Chrome Extension Blocks BeEF Attacks
An engineer has devised a new way to help combat BeEF, or browser exploit framework attacks. The tool, a Chrome extension, detects and blocks hooks from BeEF–an exploit tool similar to Metasploit–that uses JavaScript to control browsers. Routinely used by researchers, pen testers, and attackers,...
Microsoft Exchange Server CVE-2015-2359 HTML Injection Vulnerability
Description Microsoft Exchange Server is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based...
VK.com: XSS at http://vk.com on IE using flash files
Steps + Open the below url in Internet Explorer http://vk.com/swf/photouploaderlite.swf?h=h?&onMouseOver=document.writewindow.location.hash.substr1alertdocument.domain + Just hover your mouse over the page. Minor Observations + No "X-Content-Type-Options: nosniff" header allows IE to play the fla...
Unity Web Player Zero-Day Vulnerability Disclosed
Some detail has been disclosed about a zero-day vulnerability in the Unity Web Player browser plugin that can allow an attacker to use a victim’s credentials to read messages or otherwise abuse their access to online services. The partial disclosure was made after nearly six months of bug-report...
UBUNTU-CVE-2015-2708
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via unknown vectors...