WebKit Element::setAttributeNodeNS Use-After-Free

WebKit: Element::setAttributeNodeNS UAF Here's a snippet of Element::setAttributeNodeNS. ExceptionOr Element::setAttributeNodeNSAttr& attrNode ... setAttributeInternalindex, attrNode.qualifiedName, attrNode.value, NotInSynchronizationOfLazyAttribute; attrNode.attachToElementthis;...

WebKit - 'Element::setAttributeNodeNS' Use-After-Free

Element::setAttributeNodeNSAttr& attrNode ... setAttributeInternalindex, attrNode.qualifiedName, attrNode.value, NotInSynchronizationOfLazyAttribute; attrNode.attachToElementthis; treeScope.adoptIfNeededattrNode; ensureAttrNodeListForElementthis.append&attrNode; return WTFMoveoldAttrNode;...

WebKit Element::setAttributeNodeNS Use-After-Free Vulnerability

Exploit for multiple platform in category dos / poc WebKit: Element::setAttributeNodeNS UAF Here's a snippet of Element::setAttributeNodeNS. ExceptionOr Element::setAttributeNodeNSAttr& attrNode ... setAttributeInternalindex, attrNode.qualifiedName, attrNode.value,...

Cross-site Scripting (XSS)

angular.js is vulnerable to cross-site scripting XSS attacks. This vulnerability only affects the Firefox and Safari when creating an inert document. In Safari, JavaScript is sanitised using a dummy XHR element while for Firefox a DOMParser is used...

WebKit: UXSS through HTMLObjectElement::updateWidget(CVE-2017-2493)

When an object element loads a JavaScript URLe.g., javascript:alert1, it checks whether it violate the Same Origin Policy or not. Here's some snippets of the logic. void HTMLObjectElement::updateWidgetCreatePlugins createPlugins ... String url = this-url; ... if !allowedToLoadFrameURLurl return;...

DEBIAN-CVE-2017-9047

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlenbuf. If the content-type is...

CVE-2017-9047

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlenbuf. If the content-type is...

UBUNTU-CVE-2017-9048

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more...

UBUNTU-CVE-2017-9047

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlenbuf. If the content-type is...

PT-2017-4229 · Php +4 · Php +4

Name of the Vulnerable Software and Affected Versions: libxml2 version 20904-GITv2.9.4-16-g0741801 Description: A buffer overflow issue was discovered in the xmlSnprintfElementContent function, which can cause programs using libxml2, such as PHP, to crash. The problem arises when the function...

CVE-2017-6051

The CVE-2017-6051 entry concerns BLF-Tech LLC VisualView HMI, affected in versions 9.9.14.0 and earlier. The issue is an Uncontrolled Search Path Element (CWE-427) vulnerability that may allow a local attacker to cause execution of arbitrary code by loading a malicious DLL from the search path. C...

Code injection

GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a malformed P element...

CVE-2017-8762

CVE-2017-8762 affects GeniXCMS 1.0.2. The vulnerability is an XSS condition triggered when an authenticated user submits a page, demonstrated by a crafted oncut attribute in a B element. The Connected documents corroborate this across multiple sources (Red Hat, GHSA, OSV, CVE lists) with the same...

BLF-Tech LLC VisualView HMI

CVSS v3 7.0 ATTENTION: Low skill level to exploit Vendor: BLF-Tech LLC Equipment: VisualView HMI Vulnerability: Uncontrolled Search Path Element AFFECTED PRODUCTS The following VisualView HMI versions are affected: VisualView HMI Version 9.9.14.0 and prior. IMPACT Successful exploitation of this...

Chrome Universal XSS via fullscreen element updates (CVE-2016-5207)

VULNERABILITY DETAILS From /thirdparty/WebKit/Source/core/dom/Fullscreen.cpp: void Fullscreen::didEnterFullscreenForElementElement element ... // FIXME: This should not call updateStyleAndLayoutTree. document-updateStyleAndLayoutTree; ... Indeed. |didEnterFullscreenForElement| may be called in th...

Chrome Security: Universal XSS through removing link elements (CVE-2017-5010)

VULNERABILITY DETAILS When a link element is notified about its removal from the tree and the linked stylesheet happens to be the last pending one in the document, the fragment anchor may be updated, which triggers layout updates when it should be forbidden. In special circumstances, the updates...

Chrome Universal XSS using an <input type="color"> element (CVE-2016-5208)

VULNERABILITY DETAILS When an input element is removed, the popup is closed during the layout tree detach: void HTMLInputElement::detachLayoutTreeconst AttachContext& context HTMLTextFormControlElement::detachLayoutTreecontext; mneedsToUpdateViewValue = true; minputTypeView-closePopupView; If the...

UBUNTU-CVE-2017-5453

A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's "TITLE" element. This vulnerability allows for spoofing but no scripted content can be run. This vulnerability affects Firefox 53...

Cross site scripting

Zurmo 3.1.1 Stable allows a Cross-Site Scripting XSS attack with a base64-encoded SCRIPT element within a data: URL in the returnUrl parameter to default/toggleCollapse...

CVE-2017-3027

Adobe Acrobat Reader (Windows/macOS) versions 11.0.19 and earlier, 15.006.30280 and earlier, and 15.023.20070 and earlier are affected by a use-after-free in the XFA module (related to the choiceList element) that could allow arbitrary code execution on successful exploitation. The initial descri...