1066 matches found
Mozilla: Denial of Service using HTTP/2 CONTINUATION frames
The Mozilla Foundation Security Advisory describes this flaw as: There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the browser...
Mozilla: Denial of Service using HTTP/2 CONTINUATION frames
The Mozilla Foundation Security Advisory describes this flaw as: There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the browser...
CVE-2024-3856
A use-after-free could occur during WASM execution if garbage collection ran during the creation of an array. This vulnerability affects Firefox 125...
UBUNTU-CVE-2024-3302
There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10...
CVE-2024-28034
The CVE-2024-28034 entry describes a cross-site scripting (CWE-79) vulnerability in Mini Thread Version 3.33βi. An arbitrary script could be executed in the browser of users visiting a site that uses this product. The focal product is Mini Thread 3.33βi; the root cause and exact vulnerable compon...
Zerochannel 0ch BBS Script 安全漏洞
Zerochannel 0ch BBS Script is a bulletin board software from Zerochannel, Inc. A security vulnerability exists in Zerochannel 0ch BBS Script version ver.4.00, which originated from a vulnerability that allows an attacker to execute arbitrary scripts on the web browser of a user who visits a web...
Cross site request forgery (csrf)
yourspotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions 1.9.0 do not protect the API and login flow against Cross-Site Request Forgery CSRF. Attackers can use this to execute CSRF attacks on victims, allowing them to retrieve, modify or delete data on the...
The vulnerability of the Cisco Secure Client (formerly Cisco AnyConnect Secure Mobility Client) endpoint security mechanism lies in the lack of measures to neutralize CRLF sequences, allowing attackers to execute arbitrary code in the browser.
The vulnerability of the Cisco Secure Client formerly Cisco AnyConnect Secure Mobility Client security mechanism is related to the failure to handle CRLF sequences properly. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the browser, provided that the user...
BIT-ODOO-2021-44461
Cross-site scripting XSS issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the contents of accounting journal entries to inject arbitrary web script in the browser of a victim...
Mozilla Firefox Denial of Service Vulnerability (CNVD-2024-25565)
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a denial of service vulnerability caused by an invalid memory access in the built-in probe. An attacker can exploit the vulnerability to cause the browser to crash...
Cross site scripting
A reflected cross-site scripting XSS vulnerability in zhimengzhe iBarn v1.5 allows attackers to inject malicious JavaScript into the web browser of a victim via the search parameter in offer.php...
Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts
The Mozilla Foundation Security Advisory describes this flaw as: Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well as control part of the response body, they could inject Set-Cookie respon...
Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts
The Mozilla Foundation Security Advisory describes this flaw as: Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well as control part of the response body, they could inject Set-Cookie respon...
Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts
The Mozilla Foundation Security Advisory describes this flaw as: Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well as control part of the response body, they could inject Set-Cookie respon...
Design/Logic Flaw
Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well as control part of the response body, they could inject Set-Cookie response headers that would have been honored by the browser. This...
CVE-2024-1551
Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well as control part of the response body, they could inject Set-Cookie response headers that would have been honored by the browser. This...
The vulnerability of the Google Chrome and Microsoft Edge web browsers allows a hacker to execute arbitrary code.
The vulnerability of the Google Chrome and Microsoft Edge web browsers relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
The vulnerability of the user interface of the WebUI of Microsoft Edge and Google Chrome browsers allows a hacker to execute arbitrary code.
The vulnerability of the WebUI user interfaces of Microsoft Edge and Google Chrome is related to a numerical overflow condition. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...
Mozilla: Phishing site popup could show local origin in address bar
The Mozilla Foundation Security Advisory describes this flaw as: A phishing site could have repurposed an about: dialog to show phishing content with an incorrect origin in the address bar...