ThisData: Insecure Cache-Control Leading to API key Retrieval

Description: https://thisdata.com/customers/user/install/apis/number/reauthorize Does not have good browser cache management, allowing another user with access to the device to retrieve the API key. All of the thisdata.com pages do not have the cache management correctly configured, allowing the...

Tenable Network Security Nessus Cross-Site Scripting Vulnerability

Tenable Network Security Nessus is a highly scalable open source vulnerability scanner from Tenable Network Security, USA. A cross-site scripting vulnerability exists in Tenable Network Security Nessus. A remote attacker can exploit this vulnerability to execute arbitrary avaScript in the current...

Microsoft Internet Explorer Security Restriction Bypass Vulnerability

Internet Explorer is a web browser from Microsoft. A security feature bypass vulnerability exists in Microsoft Internet Explorer versions 9 through 11, which could allow a remote attacker to bypass the mixed content warning and load insecure content...

Chrome Universal XSS using IDBKeyRange static methods(CVE-2015-1268)

VULNERABILITY DETAILS Calling an object-returning static method with a cross-origin thing passed as |this| yields an object wrapped in the cross-origin scope. This is because FunctionCallbackInfo ends up with a cross-origin holder, and the holder acts as a creation context for the return value in...

This Phishing Attack is Almost Impossible to Detect On Chrome, Firefox and Opera

A Chinese infosec researcher has reported about an "almost impossible to detect" phishing attack that can be used to trick even the most careful users on the Internet. He warned, hackers can use a known vulnerability in the Chrome, Firefox and Opera web browsers to display their fake domain names...

Microsoft Edge browser vulnerability, allowing a hacker to execute arbitrary code

The vulnerability of the rendering mechanisms for executing browser scripts in Microsoft Edge arises from the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Multiple Apple Products WebKit Component Memory Misreference Vulnerability

ApplewatchOS, Safari and iOS are products of Apple Inc. watchOS is a smartwatch operating system. safari is a web browser that is the default browser that comes with MacOSX and iOS. iOS is an operating system developed for mobile devices. webKit is an open source web browser engine developed by...

Microsoft Edge browser vulnerability, allowing a hacker to execute arbitrary code

The vulnerability of the Microsoft Edge browser’s script is due to an operation that occurs outside the buffer, in dynamic memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by renaming and executing the file...

Microsoft Edge browser vulnerability, allowing a hacker to execute arbitrary code

The vulnerability of Microsoft Edge arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user...

Cross site scripting

A Cross-Site Scripting XSS was discovered in GamePanelX-V3 3.0.12. The vulnerability exists due to insufficient filtration of user-supplied data a passed to the "GamePanelX-V3-master/ajax/ajax.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the...

Cross site scripting

A Cross-Site Scripting XSS was discovered in ZoneMinder before 1.30.2. The vulnerability exists due to insufficient filtration of user-supplied data postLoginQuery passed to the "ZoneMinder-master/web/skins/classic/views/js/postlogin.js.php" URL. An attacker could execute arbitrary HTML and scrip...

Microsoft Internet Explorer Information Disclosure Vulnerability (CNVD-2017-03752)

Microsoft Internet Explorer is a Web browser developed by the American company Microsoft and is the default browser that comes with the Windows operating system. An information disclosure vulnerability exists in Microsoft Internet Explorer. An attacker could exploit this vulnerability to obtain...

Mozilla Firefox URL Spoofing Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the U.S. Thunderbird is a mail tool adapted from the mail widget of the Mozilla browser. A URL spoofing vulnerability exists in Mozilla Firefox, where an attack can use a blob URL and a script to spoof arbitrary...

Cross site scripting

A Cross-Site Scripting XSS issue was discovered in webpagetest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data benchmark passed to the webpagetest-master/www/benchmarks/view.php URL. An attacker could execute arbitrary HTML and script code in a browser in the...

UBUNTU-CVE-2017-5417

When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the addressbar so that the displayed location following navigation does not match the URL of the newly loaded page. This allows for spoofing attacks. This vulnerability affects...

CVE-2017-6392

An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "server-Lynx-12.11.0/adminconsole/web/tools/XmlJWPlayer.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the contex...

The vulnerability of Safari browser, the iOS operating system, and the multimedia player iTunes allows attackers to trigger a service failure or execute arbitrary code.

The vulnerability of the WebKit component in the Safari browser and the iOS operating system, as well as in the multimedia player iTunes, arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or...

LocalTapiola: Brute force unsubscription on /webApp/unsub_sb (viestinta.lahitapiola.fi)

Basic report information Summary: CSRF is an attack that tricks the victim into submitting a malicious request. It inherits the identity and privileges of the victim to perform an undesired function on the victim's behalf Description: Any user subscribed to Active Campaign, or admin too, attacker...

Google Chrome Blink Generic Cross-Site Scripting Vulnerability (CNVD-2017-02109)

Google Chrome is a popular web browser. A generic cross-site scripting vulnerability exists in Google Chrome Blink, which allows remote attackers to exploit the vulnerability to build malicious WEB pages that can be parsed by users and can be executed with arbitrary code...

Multiple Cross-Site Scripting Vulnerabilities in ZoneMinder

ZoneMinder is a security monitoring software for cameras. ZoneMinder suffers from multiple cross-site scripting vulnerabilities that allow an attacker to remotely execute malicious scripts in the browser of an authenticated client...