NetEase(163,126) Mail Persistent XSS Vulnerability

This ia a 0day XSS vulnerability. The vulnerability for Netease email163,126 that works on all operating systems and browsers. Android and iPhone sometimes don't work You can easily obtain the users session and password with this XSS. Also, QQ-XSS vulnerability will be uploaded soon. Thank you...

CVE-2020-1219

A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corruption Vulnerability'...

Remote code execution

A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corruption Vulnerability'...

CVE-2020-1219

CVE-2020-1219 affects Microsoft browsers (IE11/Edge) where memory objects are accessed in memory, causing memory corruption. Root cause: improper handling of memory in the browser’s object access path, enabling arbitrary code execution. Impact: remote code execution with the current user’s rights...

CVE-2020-1219

A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corruption Vulnerability'...

KLA11813 Multiple vulnerabilities in Microsoft Browsers

Multiple vulnerabilities were found in Microsoft Browsers. Malicious users can exploit these vulnerabilities to obtain sensitive information, execute arbitrary code, spoof user interface. Below is a complete list of vulnerabilities: 1. An information disclosure vulnerability in Internet Explorer...

vulhub

This is an open-source collection of pre-built vulnerable docker environments. It is not a PoC exploit for a specific CVE, but rather a toolkit for testing and training purposes. The repository contains a variety of vulnerable environments, including Flask SSTI, Apache Parsing Vulnerability, and...

Python and Go Top the Chart of 2019’s Most Popular Hacking Tools

Imperva Cloud WAF protects over a hundred thousand websites globally and observes around a billion of attacks daily. We detect thousands of hacking tools on a daily basis and employ various measures to stop malicious requests. Here are the most dangerous tools and attacks we discover while...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Squid vulnerabilities (USN-4356-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4356-1 advisory. Jeriko One discovered that Squid incorrectly handled certain Edge Side Includes ESI responses. A malicious remote server could...

Cross-Site Scripting in "SVG Sanitizer" (svg_sanitizer)

Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it is still evaluated in browsers can lead to Cross-Site Scripting...

CVE-2020-11767

Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection negotiated with SNI over HTTPS to .example.com, a request for a domain concurrently configured explicitly e.g., abc.example.com is sent to the servers listening behind .example.com. The outcome shoul...

Design/Logic Flaw

Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection negotiated with SNI over HTTPS to .example.com, a request for a domain concurrently configured explicitly e.g., abc.example.com is sent to the servers listening behind .example.com. The outcome shoul...

KLA11749 Multiple vulnerabilities in Microsoft Browsers

Multiple vulnerabilities were found in Microsoft Browsers. Malicious users can exploit these vulnerabilities to execute arbitrary code. Below is a complete list of vulnerabilities: 1. A memory corruption vulnerability in Scripting Engine can be exploited remotely via specially crafted website to...

Cross-Site Scripting (XSS)

tomcat5 is vulnerable to cross-site scripting XSS. The Tomcat security update RHSA-2009:1164 did not, unlike the erratum text stated, provide a fix for CVE-2009-0781, a cross-site scripting XSS flaw in the examples calendar application. With some web browsers, remote attackers could use this flaw...

Spoofing Attack

nspr is vulnerable to spoofing attacks. Dan Kaminsky found that browsers still accept certificates with MD2 hash signatures, even though MD2 is no longer considered a cryptographically strong algorithm. This could make it easier for an attacker to create a malicious certificate that would be...

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird, related to the lack of measures to protect the structure of web pages, allows attackers to execute cross-site scripting attacks.

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird relates to certain elements that may contain parentheses. Through these elements, it is possible to inject closing tags. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting...

linkmobility.fr Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1136001 Security Researcher Broly157 Helped patch 1571 vulnerabilities Received 7 Coordinated Disclosure badges Received 15 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting linkmobility.fr website a...

CVE-2019-19002

For ABB eSOMS versions 4.0 to 6.0.2, the X-XSS-Protection HTTP response header is not set in responses from the web server. For older web browser not supporting Content Security Policy, this might increase the risk of Cross Site Scripting...

CVE-2019-19000 eSOMS Cachecontrol (Pragma) HTTP Header

For ABB eSOMS 4.0 to 6.0.3, the Cache-Control and Pragma HTTP headers have not been properly configured within the application response. This can potentially allow browsers and proxies to cache sensitive information...

Fedora: Security Advisory for gd (FEDORA-2020-e795f92d79)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...