CVE-2015-6144

Microsoft Internet Explorer 8 through 11 and Microsoft Edge mishandle HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting XSS protection mechanism via unspecified vectors, aka "Microsoft Browser XSS Filter Bypass Vulnerability."...

CVE-2015-6139

Microsoft Internet Explorer 11 and Microsoft Edge mishandle content types, which allows remote attackers to execute arbitrary web script in a privileged context via a crafted web site, aka "Microsoft Browser Elevation of Privilege Vulnerability."...

Memory corruption

Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6140, CVE-2015-6142,...

Memory corruption

Microsoft Internet Explorer 8 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6083...

CVE-2015-6161

Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Browser ASLR Bypass."...

CVE-2015-6144

Microsoft Internet Explorer 8 through 11 and Microsoft Edge mishandle HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting XSS protection mechanism via unspecified vectors, aka "Microsoft Browser XSS Filter Bypass Vulnerability."...

CVE-2015-6139

Microsoft Internet Explorer 11 and Microsoft Edge mishandle content types, which allows remote attackers to execute arbitrary web script in a privileged context via a crafted web site, aka "Microsoft Browser Elevation of Privilege Vulnerability."...

CVE-2015-6154

Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6150...

A Quick Glance at Modern Browsers's Protection Part #1

tl;dr in this blog post we are going to give a look at modern browsers's protection with some hands on example available at and deployed in Heroku. This blog post is NOT about Same-origin policy Introduction In this blog post we are going to give a look at modern browsers's protection. More...

Imgur: Attack User Privacy Settings - X-Frame-Options missing on m.imgur.com/user/username/settings

Hello, I would like to report that almost entire mobile web site is vulnerable to clickjacking attacks, Maybe the most important critical part the /settings node, As an attacker could force a user to change his privacy settings with only two clicks, please see live video demonstration, of course...

Samsung Android 5. 0 device WifiCredService remote code execution-vulnerability warning-the black bar safety net

The vulnerability is in a few months ago is Google Project Zero and the Quarkslab team found, has only recently been disclosed. The vulnerability only requires the user to browse a website or download a mail attachment or by the basic will not have any rights of a third party malicious programs c...

Dell Shipping Superfish-Style Root Cert, Private Key

Update Just in time for Black Friday, various models of new Dell computers are shipping with a preinstalled root certificate and private key that corresponds to the cert, which as of earlier today was being accepted by all major browsers except Firefox. Given that a number of tools exist to aid i...

CVE-2015-6088

Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Browser ASLR Bypass."...

CVE-2015-6064

Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6084 and CVE-2015-6085...

CVE-2015-6088

Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Browser ASLR Bypass."...

CVE-2015-6078

Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6065...

Suspicious Plugin Detector Information Disclosure

An information disclosure vulnerability has been reported in multiple web browsers. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitive information about the client's system...

InVision: X-Frame-Options Header Not Set

Hi , Wamim Here With a dising issue iMPACT : X-Frame-Options header is not included in the HTTP response to protect against 'ClickJacking' attacks. Soliution : Most modern Web browsers support the X-Frame-Options HTTP header. Ensure it's set on all web pages returned by your site if you expect th...

Let's Encrypt Free SSL/TLS Certificate Now Trusted by Major Web Browsers

Yes, Let's Encrypt is now one step closer to its goal of offering Free HTTPS certificates to everyone. Let's Encrypt – the free, automated, and open certificate authority CA – has announced that its Free HTTPS certificates are Now Trusted and Supported by All Major Browsers. Let's Encrypt enables...

Keybase: xss

This xss issue only affects content sniffing browsers older versions that don't see the X-Content-Type-Options: nosniff header that you're sending. https://keybase.io//api/1.0/user/lookup.json?usernames=fakeuser1%2cfakeuser2'%22%26%25prompt/XSS/ This returns a page that contains this information:...