PT-2019-6365 · Mozilla +2 · Firefox +2

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 70 Description: The issue is related to a compromised child process that could inject XBL Bindings into privileged CSS rules, leading to arbitrary code execution and a sandbox escape. It is also described as a...

Joomla ChronoForms 6.0.17 SQL Injection

Exploit Title : Joomla ChronoForms Components 6.0.17 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 26/02/2019 Vendor Homepage : chronoengine.com Software Download Link : chronoengine.com/chronoforms Software Information Link :...

Grammarly: DOM based CSS Injection on grammarly.com

Summary: An attacker can inject an external css file which can lead to phishing attacks and xss in older browsers. Description: Within the main.js file the following code exists: javascript t.prototype.componentWillMount = function var e = this.getCtx.nav.waypoint.query, t = e.extcss, n =...

WordPress: Stored XSS in Post Preview as Contributor

Root cause I noticed that the getthecontent makes a pregreplacecallback after all other validation and sanitization has been performed. function getthecontent $morelinktext = null, $stripteaser = false global $page, $more, $preview, $pages, $multipage; $post = getpost; ... if $preview // Preview...

Regular Expression Denial of Service

Overview Version of clean-css prior to 4.1.11 are vulnerable to Regular Expression Denial of Service ReDoS. Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service. Recommendation Upgrad...

KLA11409 Multiple vulnerabilities in Apple iCloud

Multiple vulnerabilities were found in Apple iCloud. Malicious users can exploit these vulnerabilities to execute arbitrary code, perform cross-site scripting attack. Below is a complete list of vulnerabilities: 1. Multiple memory corruption vulnerabilities in SQLite can be exploited remotely to...

Sql injection

An issue was discovered in CSS-TRICKS Chat2 through 2015-05-05. The userid parameter in jumpin.php has a SQL injection vulnerability...

CVE-2019-7316

An issue was discovered in CSS-TRICKS Chat2 through 2015-05-05. The userid parameter in jumpin.php has a SQL injection vulnerability...

CVE-2019-7316

An issue was discovered in CSS-TRICKS Chat2 through 2015-05-05. The userid parameter in jumpin.php has a SQL injection vulnerability...

CVE-2019-7316

CVE-2019-7316 concerns CSS-TRICKS Chat2 (up to 2015-05-05). The issue is a SQL injection in the userid parameter of jumpin.php, exposing a vulnerability in input handling. The CVSS indicates high to critical impact: network attack vector, no authentication, and partial to high impact on confident...

CVE-2019-7316

An issue was discovered in CSS-TRICKS Chat2 through 2015-05-05. The userid parameter in jumpin.php has a SQL injection vulnerability...

PT-2019-18525

Name of the Vulnerable Software and Affected Versions CSS-TRICKS Chat2 versions through 2015-05-05 Description An issue was discovered in the software, where the userid parameter in the "jumpin.php" endpoint has a SQL injection issue. Recommendations For CSS-TRICKS Chat2 versions through...

CVE-2019-7316: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in CSS-TRICKS Chat2 through 2015-05-05. The userid parameter in jumpin.php has a SQL injection vulnerability...

BEEMKA: Basic Electron Post-Exploitation Framework

PenTestIT RSS Feed There are a lot of applications today that use Electron Framework, as it helps you build cross platform desktop apps with JavaScript, HTML, and CSS. Examples are applications such as Skype, Station, etc. A new post-exploitation framework - BEEMKA can now help you in maintaining...

KLA11411 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: Use-after-free vulnerability can be exploited remotely via specially designed HTML5...

KLA11408 Multiple vulnerabilities in Apple iTunes

Multiple vulnerabilities were found in Apple iTunes. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, execute arbitrary code, perform cross-site scripting attack. Below is a complete list of vulnerabilities: 1. A memory corruption vulnerability i...

Cross-Site Scripting in Bootstrap CSS toolkit

More info at https://typo3.org/security/advisory/typo3-core-sa-2019-006...

Cross-Site Scripting in Bootstrap CSS toolkit

More info at https://typo3.org/security/advisory/typo3-core-sa-2019-006...

Cross-Site Scripting in Bootstrap CSS toolkit

It has been discovered that the third party library Bootstrap CSS toolkit is vulnerable to cross-site scripting. Details are mentioned in a dedicated vulnerability report at...

@antarctica/bas-style-kit (>=0.5.0-alpha, <=0.5.0), @antistatique/retraitespopulaires-styleguide (>=0.0.1, <=1.8.4) +152 more potentially affected by CVE-2018-20677 via bootstrap-sass (>=3.1.1, <=3.3.7)

bootstrap-sass NPM version =3.1.1, =0.5.0-alpha, =0.0.1, =0.0.1, =0.533.0, =8.0.0, =0.1.0, =2.0.2, =0.1.0, =0.0.1, =1.0.0, =1.0.1 - @opuscapita/oc-common-ui 8.3.3 and more Source cves: CVE-2018-20677 Source advisory: OSV:GHSA-PH58-4VRJ-W6HR...