Mapbox Mapbox.js HTML Injection Vulnerability

Mapbox Mapbox.js is a JavaScript plugin for quickly creating maps. An HTML injection vulnerability exists in Mapbox Mapbox.js, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user...

eBay Vulnerability Opens Users Up to Phishing, Data Theft

Researchers are warning that some visitors to eBay.com could be tricked into opening a page on the site that could expose them to phishing attacks and data theft. The vulnerability exists in the site’s online sales platform, according to Roman Zaikin, a researcher with Check Point. With it, an...

Data Theft Hole Identified in LG G3 Smartphones

A group of researchers are encouraging any smartphone users who own an LG G3 to upgrade their devices after coming across a serious security vulnerability. If exploited the bug could enable an attacker to run arbitrary JavaScript, and lead to a handful of issues, including data theft, phishing...

Multiple Cross-Site Scripting Vulnerabilities in SAP NetWeaver

SAP NetWeaver is a service-oriented, integrated application platform. A cross-site scripting vulnerability exists in SAP NetWeaver, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user...

IBM Host On-Demand Cross-Site Scripting Vulnerability

IBM Host On-Demand is a suite of terminal emulator applications for Java emulation that provides secure browser-based access to host applications and data through browser-based emulation and supports the rapid creation of customized Web applications using the Java toolset, among other things. A...

The vulnerability of the Internet Explorer browser, which allows a violator to access information

The vulnerability of the Internet Explorer browser is related to deficiencies in the implementation of inter-domain interaction policies. Exploiting this vulnerability allows a malicious actor to obtain information from one domain and inject it into another domain...

HackerOne: HTML injection can lead to data theft

Hey, This is more like an in-depth security thing with a reasonable attack scenario. In some occasions, it seems to be possible to leak sensitive data to an external server, not affected by the CSP. This can happen in the following situation: 1. There's a HTML injection vulnerability 2. The...

SAP HANA 4 Cross Site Scripting

SAP Hana Cloud Platform Cockpit Cross site Scripting Vulnerabilities ======================================================================== Vender: SAP Product: SAP HANA CLoud Vulnerability Type: Cross site scripting Title: SAP Hana Cloud Cross scripting in User Display Name Details: SAP Hana...

D-Link Webcam Hack Turns IoT Device into Backdoor

Connecting a webcam to your home or office network might seem like a harmless thing, but researchers have figured out how to turn that connected device into a backdoor. Researchers at Vectra Networks today released a report demonstrating how a $30 D-Link webcam can be abused by attackers and turn...

CentOS Update for thunderbird CESA-2016:0001 centos5

Check the version of thunderbird SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882354";...

ASUS Japan WL-330NUL Device Cross-Site Scripting Vulnerability

The ASUS Japan WL-330NUL is a portable wireless LAN router from ASUS. The ASUS Japan WL-330NUL suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user...

Google browser plug-in AVG Web TuneUp aeration multiple high-risk vulnerabilities, affect 9 0 0 million users-vulnerability warning-the black bar safety net

This year 8 month 1 5 days, from project zero members Tavis submit a Google browser plug-in AVG Web TuneUp multiple vulnerabilities, since the plug-in active users of about 9 0 0 million, so the impact range is very wide. This plugin adds a lot of api used to operate Google Chrome, for example, c...

The vulnerability of the Firefox browser allows attackers to obtain confidential information, increase their privileges, or perform XSS attacks.

The vulnerability of Firefox browsers is related to deficiencies in access control for certain functions. Exploiting this vulnerability allows a malicious actor to enhance their privileges, carry out XSS attacks, or potentially obtain confidential information through a specially crafted website...

CVE-2015-7932

Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to obtain sensitive information by sniffing the network...

dmv.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-119151 Description| Value ---|--- Affected Website:| dmv.com Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat Sheet Vulnerable URL...

TYPO3 'typoLink()' function cross-site scripting vulnerability

TYPO3 is a free and open source content management system. TYPO3 suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when...

SlemBunk: An Evolving Android Trojan Family Targeting Users of Worldwide Banking Apps

FireEye mobile researchers recently identified a series of Android trojan apps that are designed to imitate the legitimate apps of 33 financial management institutions and service providers across the globe. We dub the family “SlemBunk,” and have seen it covering three major continents: North...

Belkin N150 Wireless Home Router Session Hijacking Vulnerability

Belkin N150 Wireless Home is a wireless router product from Belkin USA. A session hijacking vulnerability exists in the Belkin N150 Wireless Home Router, which could be exploited by an attacker to hijack a user session and obtain sensitive information...

Instacart: Cookie-Based Injection

Hi Security Team instacart I'm Found Vulnerability Cookie-Based Injection It's may be possible to steal or manipulate session and cookies if attacker can injection XSS . details --- in path /help/ contain header in cookie paramter ahoyvisitor and ahoyvisit it's allow injection because re request...

Same-origin policy violation using performance.getEntries and history navigation — Mozilla

Security researcher cgvwzq reported that it is possible to read cross-origin URLs following a redirect if performance.getEntries is used along with an iframe to host a page. Navigating back in history through script, content is pulled from the browser cache for the redirected location instead of...