Multiple Browsers Denial of Service (Browser Reaper)

A denial-of-service vulnerability has been reported in Multiple Web Browsers. Successful exploitation of this vulnerability would allow a remote attacker to create a denial of service condition on the affected browser...

Mail.ru: XSS in touch.mail.ru

Browser specific user assisted DOM based XSS in message editor undo functionality via quoted content. Vulnerability did not affected mobile browsers used by majority of touch.mail.ru web interface users...

GitLab: Stored XSS in merge request pages

Summary: I found a Stored XSS in merge request pages. Description: The exploit is via the parameter mergerequestsourcebranch of the request to create a New Merge Request. Steps To Reproduce: 1. Sign ikn to GitLab. 2. Click the "+" icon. 3. Click "New Project". 4. Fill out "Project name" form with...

Multiple FXC network devices vulnerable to cross-site scripting

Overview Multiple network devices provided by FXC Inc. contain a stored cross-site scripting vulnerability CWE-79. SUNAGAWA, Masanori of Japan Advanced Institute of Science and Technology Graduate School of Advanced Science and Technology Security and Networks reported this vulnerability to IPA...

Information disclosure

An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft browsers, aka "Scripting Engine Information Disclosure Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge...

CVE-2018-8457

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 11, Microsoft Edge, Internet Explorer 10. This CVE ID is unique from CVE-2018-8354,...

CVE-2018-8457

Technical details about CVE-2018-8457 are not provided in the connected documents; the initial description is high-level. Monitor for updates.

Beware! Unpatched Safari Browser Hack Lets Attackers Spoof URLs

A security researcher has discovered a serious vulnerability that could allow attackers to spoof website addresses in the Microsoft Edge web browser for Windows and Apple Safari for iOS. While Microsoft fixed the address bar URL spoofing vulnerability last month as part of its monthly security...

KLA11318 Multiple vulnerabilities in Microsoft Browsers

Multiple vulnerabilities were found in Microsoft Browsers. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, gain privileges, bypass security restrictions, spoof user interface. Below is a complete list of vulnerabilities: 1. A memory...

KB4457145: Windows 7 and Windows Server 2008 R2 September 2018 Security Update

The remote Windows host is missing security update 4457145 or cumulative update 4457144. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could...

Lenovo Replacing Distrusted GeoTrust Certificates With New DigiCert Certificates - US

Lenovo Security Advisory: LEN-24497 Scope of Impact: Industry-wide. Anyone using a GeoTrust certificate will need to update to DigiCert. Major browsers will stop trusting GeoTrust certificates as early as October. Summary Description: Many Lenovo sites use PKI certificates issued by the GeoTrust...

AZORult Stealer 2 Botnet SQL Injection Vulnerability

Exploit for php platform in category web applications Title: AZORult Stealer v2 Botnet - SQL injection Credit: Bilal KARDADOU URL: https://www.rekings.com/shop/azorult-stealer/ Product: 'AZORult Stealer v2 Botnet' Type: Paid Google Dork: N/A Description: Stealer of stored passwords, cookies,...

AZORult Stealer 2 Botnet SQL Injection

Title: AZORult Stealer v2 Botnet - SQL injection Credit: Bilal KARDADOU URL: https://www.rekings.com/shop/azorult-stealer/ Product: 'AZORult Stealer v2 Botnet' Type: Paid Google Dork: N/A Description: Stealer of stored passwords, cookies, autocomplete from browsers: Google Chrome, Mozilla Firefox...

Explainer Series: What is Clickjacking?

Here we go, another online trap ready to ensnare unsuspecting – well, until now anyway – users. As if Phishing, Cryptojacking, credential stuffing and old school scamming wasn’t enough, folks really just can’t catch a break these days. Anyway, we’re here to chat about clickjacking, for those of y...

Adobe Flash - AVC Processing Out-of-Bounds Read

Adobe Flash - AVC Processing Out-of-Bounds Read The attached fuzz file causes an out-of-bounds read in AVC processing. To reproduce the issue, put both attached files on a server, and vist: http://127.0.0.1/LoadMP4.swf?file=transpose.mp4 This issue reproduces on Chrome and Firefox for Linux. Proo...

Cross-Site Scripting (XSS)

atmosphere-runtime is vulnerable to cross-site scripting XSS. The JSONP transport method does not specify the content-type header when responding with the JSONP callback parameter, which causes web browsers to render the response when the parameter contains HTML and Javascript. This allows a remo...

CVE-2018-8403

A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corruption Vulnerability." This affects Internet Explorer 11, Microsoft Edge, Internet Explorer 10...

CVE-2018-8385

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, ChakraCore, Internet Explorer 11, Microsoft Edge, Internet Explorer 10. This CVE ...

CVE-2018-8357

An elevation of privilege vulnerability exists in Microsoft browsers allowing sandbox escape, aka "Microsoft Browser Elevation of Privilege Vulnerability." This affects Internet Explorer 11, Microsoft Edge...

CVE-2018-8351

An information disclosure vulnerability exists when affected Microsoft browsers improperly allow cross-frame interaction, aka "Microsoft Browser Information Disclosure Vulnerability." This affects Internet Explorer 11, Microsoft Edge, Internet Explorer 10...