Code injection

The Admin control panel in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2016-9413

The Admin control panel in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2016-9413

The Admin control panel in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2016-9413

The CVE-2016-9413 entry affects MyBB Admin control panel and MyBB Merge System prior to 1.8.7. The underlying issue is clickjacking via unspecified vectors, enabling remote attackers to perform clickjacking against affected admin interfaces. The vulnerable components are the Admin control panel a...

PT-2017-10129

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.7 MyBB Merge System versions prior to 1.8.7 Description The issue allows remote attackers to conduct clickjacking attacks. Recommendations For MyBB versions prior to 1.8.7, update to version 1.8.7 or later. For MyBB...

CVE-2016-9413: Improper Access Control

The Admin control panel in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

Pushwoosh: Clickjacking

Steps to reproduce: create index.html file with following content: Open index.html in browser Actual result: Pushwoosh viewed in iframe. Expected result: do not allow clickjacking Root cause: var isInIFrame = function try return window.self !== window.top; catch e return true; ;...

Clickjacking Vulnerability in HP Diagnostics

HP Diagnostics is a suite of end-to-end application management, monitoring, diagnostic analysis and troubleshooting solutions from Hewlett-Packard. A clickjacking vulnerability exists in HP Diagnostics. An attacker could exploit this vulnerability to steal cookie-based authentication credentials...

X (Formerly Twitter): Clickjacking Periscope.tv on Chrome

Hi, The X-FRAME-OPTIONS header returned from https://www.periscope.tv is: X-Frame-Options: ALLOW-FROM https://twitter.com/ But Chrome doesn't support this value for the header: https://www.owasp.org/index.php/ClickjackingDefenseCheatSheet. Because of that, no value for X-FRAME-OPTIONS is set and...

Multiple IBM Product Clickjacking Vulnerabilities

IBM InfoSphere DataStage and InfoSphere Information Server on Cloud are both products of IBM USA. The former is a set of graphical interface to provide data integration solutions ETL data extraction, transformation and loading tools, the latter is a set of cloud-based data integration platform. A...

Yelp: Clickjacking @ Main Domain[www.yelp.com]

Hello Yelp Security Team, I Just want to submit a report Clickjacking on your Main Domain, I Know that this is a Low Risk But may i know if your aware of it. PoC: See Atachments. Impact: For example, imagine an attacker who builds a web site that has a button on it that says "click here for a fre...

Snapchat: RTLO char allowed in chat

Hey all, There seems to be no filtering of strange unicode characters such as U+202E which is an Right-To-Left-Override. I can send messages like "Hey check out my new song at example.com/songrtlo3pm.exe" and everyone would see the link as "example.com/songexe.mp3". Links that end with .exe are...

Red Hat JBoss Enterprise Application Platform (EAP) < 6.4.4 Multiple Vulnerabilities

Red Hat JBoss Enterprise Application Platform EAP is prone to multiple vulnerabilities. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Verizon Webmail client stored XSS vulnerability-vulnerability warning-the black bar safety net

Write in front of words Before that, I had specialized to write a technical article to explain in detail through Verizon Webmial client of server-side vulnerabilities article transfer gate button. But I recently went in this client found some very interesting vulnerabilities, these vulnerabilitie...

CVE-2016-0317

Lifecycle Query Engine LQE in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2016-0317

Lifecycle Query Engine LQE in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

Code injection

Lifecycle Query Engine LQE in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2016-0317

The CVE-2016-0317 issue affects IBM Jazz Reporting Service’s Lifecycle Query Engine (LQE) shipped with Jazz Reporting Service 6.0 and 6.0.1 (prior to 6.0.1 iFix006). The vulnerability enables remote attackers to hijack click actions (clickjacking) via unspecified vectors. The IBM advisory groups ...

CVE-2016-0317

Lifecycle Query Engine LQE in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2016-0317: Improper Access Control

Lifecycle Query Engine LQE in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote attackers to conduct clickjacking attacks via unspecified vectors...