Symantec Endpoint Protection Manager and Client Design Vulnerability

Symantec Endpoint Protection SEP is a suite of antivirus software from Symantec Corporation. The software provides security across physical and virtual systems.SEP Manager and Client are the management and client software. A design flaw exists in the management console of Symantec Endpoint...

The vulnerability of Google Chrome browser allows a violator to circumvent existing access restrictions policies.

The vulnerability of the Google Chrome browser’s DOM component is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to circumvent existing access control policies by using a specially crafted website...

Google Chrome DOM Homology Policy Bypass Vulnerability (CNVD-2016-01234)

Google Chrome is a popular web browser. Google Chrome's DOM implementation process fails to properly handle the execution order of frame-attach and frame-detach operations, allowing remote attackers to build specially crafted Web sites to bypass the same-origin policy...

jenkins: password exposure in DOM (SECURITY-138)

Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for the password field of a parameterized job by reading the DOM...

The vulnerabilities of PDF viewing and editing programs like Adobe Reader, Document Cloud, Adobe Reader, and Adobe Acrobat allow attackers to execute arbitrary code.

The vulnerability of the Doc object implementation in PDF file viewing and editing programs like Adobe Reader, Document Cloud, Adobe Reader, and Adobe Acrobat is related to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code...

Google Blink DOM Homology Policy Bypass Vulnerability

Blink is the United States Google Google Inc. and Norway Opens Opera Software company jointly developed a set of browser layout engine rendering engine. A security vulnerability exists in the DOM implementation of Blink used in versions of Google Chrome prior to 47.0.2526.73, which stems from the...

UBUNTU-CVE-2015-6770

The DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-6768...

chromium-browser: Cross-origin bypass in DOM

The DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-6768...

Google Chrome DOM Homology Bypass Vulnerability

Google Chrome is a WEB-based browser. A vulnerability in the Google Chrome Blink implementation allows remote attackers to construct malicious WEB pages that can be tricked into parsing by users, which can bypass the same-origin policy and execute special script code...

chromium-browser: Cross-origin bypass in DOM

The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not check whether a node is expected, which allows remote attackers to bypass the Same Origin Policy or cause a denial of service DOM tree corruption via a web...

The vulnerability of the Firefox browser, which allows a hacker to execute arbitrary code on the client side

The vulnerability of the CSPService::ShouldLoad function in Firefox browsers is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code on the client side by manipulating the DOM objects...

The vulnerability of the Thunderbird email client, allowing a hacker to execute arbitrary code on the client side

The vulnerability of the CSPService::ShouldLoad function in the Thunderbird email client is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the client side by manipulating the DOM objects...

The vulnerability of the Firefox ESR browser allows a hacker to execute arbitrary code on the client side.

The vulnerability of the CSPService::ShouldLoad function in Firefox ESR browsers is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the client side by manipulating the DOM objects...

Firefox 39 Out With Patches for Four Critical Vulnerabilities

Mozilla has rolled out a new version of its Firefox browser, an update that includes patches for four critical security vulnerabilities and several less-severe bugs. IN all, Firefox 39 patches 13 vulnerabilities, including two high-risk bugs and six moderate-level ones. The most dangerous...

Use-after-free in Content Policy due to microtask execution error — Mozilla

Security researcher Herre reported a use-after-free vulnerability when a Content Policy modifies the Document Object Model to remove a DOM object, which is then used afterwards due to an error in microtask implementation. This leads to an exploitable crash...

php: missing null byte checks for paths in DOM and GD extensions

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions...

UBUNTU-CVE-2015-4598

PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls 1 a DOMDocument save method or 2 the GD imagepsloadfont function...

Multiple Cisco Products Cross-Site Scripting Vulnerabilities

Cisco AnyConnect Secure Mobility Client is a mobile client VPN tool.Cisco HostScan Engine is a host scanning engine. Cisco AnyConnect Secure Mobility Client and Cisco Host Scan fail to properly validate URLs used to construct applet paths in the DOM, allowing attackers to conduct cross-site...

chromium-browser: use-after-free in DOM

Use-after-free vulnerability in core/events/TreeScopeEventContext.cpp in the DOM implementation in Blink, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper...

USN-2476-1 oxide-qt vulnerabilities

Several memory corruption bugs were discovered in ICU. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process...