CVE-2017-5464

During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

CVE-2017-5434

A use-after-free vulnerability occurs when redirecting focus handling which results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

Code injection

A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an attacker to spoof an existing page without the malicious page's address being displayed correctly. This vulnerability affects Firefox 52...

CVE-2017-5422

CVE-2017-5422 describes a denial-of-service crash triggered by repeatedly using the view-source: protocol within a single hyperlink. The issue affects Mozilla Firefox and Thunderbird prior to version 52. The root cause is tied to how the view-source: protocol was handled in a chained hyperlink, a...

Design/Logic Flaw

i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted user input can use the name of one of the dictionary keys to inject script into the browser. This affects i18next =1.10.2...

HPE UCMDB Configuration Manager Software Cross-Site Scripting Vulnerability

HPE UCMDB full name Universal CMDB is the United States Hewlett Packard Enterprise HPE company's set of resource management solutions. The solution provides from the bottom up including IT infrastructure auto-discovery, data modeling, service mapping definition and service impact analysis, etc...

Malicious Package

Overview Version 0.0.3 of jasmin contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.0.3 of this module is found installed you...

CVE-2018-9111

Cross Site Scripting XSS exists on the Foxconn FEMTO AP-FC4064-T APGTB385.8.3lb15-W47 LTE Build 15 via the configuration of a user account. An attacker can execute arbitrary script on an unsuspecting user's browser...

Microsoft Edge Security Feature Bypass Vulnerability (CNVD-2018-10732)

Microsoft Windows 10 and Windows Server 2016 are both products of Microsoft Corporation.Microsoft Windows 10 is a set of operating systems for personal computers.Windows Server 2016 is a set of server operating systems.Edge is one of the a default browser that comes with the system. A security...

Brave Browser < 0.13.0 - 'long alert() argument' Denial of Service

Exploit Title:Brave Browser...

Microsoft Internet Explorer Scripting Engine Information Disclosure Vulnerability (CNVD-2018-08029)

Internet Explorer is a web browser from Microsoft. An information disclosure vulnerability exists in the scripting engine of Microsoft Internet Explorer. An attacker could exploit this vulnerability to obtain information that could further compromise a user's computer or data...

Mozilla Firefox memory misreference vulnerability (CNVD-2018-07091)

Mozilla Firefox browser Firefox is a free, open source browser for Windows, Linux and MacOSX platforms. Mozilla Firefox suffers from a memory misreference vulnerability when manipulating elements, events, and selection ranges during editor operations. An attacker could exploit this vulnerability ...

USN-3584-1 sensible-utils vulnerability

Gabriel Corona discovered that sensible-utils incorrectly validated strings when launcher a browser with the sensible-browser tool. A remote attacker could possibly use this issue with a specially crafted URL to conduct an argument injection attack and execute arbitrary code...

Microsoft Edge and ChakraCore Remote Memory Corruption Vulnerability (CNVD-2018-03520)

Microsoft Windows 10 is a next-generation cross-platform operating system from Microsoft.Edge is one of the browsers that comes with the system.ChakraCore is the core of an open-source JavaScript engine that is used in Edge, and can also be used as a stand-alone JavaScript engine. engine. A remot...

Mozilla Firefox Information Disclosure Vulnerability (CNVD-2018-02232)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in versions prior to Mozilla Firefox 58. The vulnerability can be exploited by an attacker to access cookie values when an existing cookie is set to HttpOnly...

Mozilla Firefox Information Disclosure Vulnerability (CNVD-2018-02264)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in versions of Mozilla Firefox prior to 58. A remote attacker could exploit the vulnerability to capture audio streams...

BigTree cross-site scripting vulnerability (CNVD-2018-03229)

Fastspot BigTree is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A cross-site scripting vulnerability exists in the core/admin/ajax/developer/extensions/file-browser.php file in version 4.2.19 of Fastspot BigTree. A remote attacker can explo...

hotelamersfoorta1.nl XSS vulnerability

Open Bug Bounty ID: OBB-483567 Description| Value ---|--- Affected Website:| hotelamersfoorta1.nl Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosur...

The vulnerability of the Apps Bluetooth component of Google Chrome browser allows a hacker to read data beyond the memory limit.

The vulnerability of the Google Chrome browser’s Bluetooth component relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to read data beyond the memory limit, using a specially crafted HTML page...

UBUNTU-CVE-2017-17512

sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument...