WebKit CachedFrame Universal Cross Site Scripting

WebKit: UXSS: CachedFrame doesn't detach openers CVE-2017-2528 When a document loads "about:blank" or "about:srcdoc", it tries to inherit the security origin from its parent frame, or its opener frame if the parent frame doesn't exist. Normally, it doesn't happen that a subframe's document inheri...

Apple macOS - 'stackshot' Raw Frame Pointers(CVE-2017-2516)

This is an issue that allows unentitled root to read kernel frame pointers, which might be useful in combination with a kernel memory corruption bug. By design, the syscall stacksnapshotwithconfig permits unentitled root to dump information about all user stacks and kernel stacks. While a target...

[SECURITY] Fedora 25 Update: libvncserver-0.9.11-2.fc25.1

LibVNCServer makes writing a VNC server or more correctly, a program expor ting a frame-buffer via the Remote Frame Buffer protocol easy. It hides the programmer from the tedious task of managing clients and compression schemata...

[SECURITY] Fedora 24 Update: libvncserver-0.9.11-2.fc24.1

LibVNCServer makes writing a VNC server or more correctly, a program expor ting a frame-buffer via the Remote Frame Buffer protocol easy. It hides the programmer from the tedious task of managing clients and compression schemata...

Cuvva: Clickjacking vulnerability in support-dashboard.corp.cuvva.co

Hi i found a clickjacking vulnerability in the subdomain of cuvva.com i.e, support-dashboard.corp.cuvva.co Impact: The resource without X-Frame-Options potentially vulnerable to the Clickjacking. The vulnerability exist only for authenticated users possible UI redressing in the Dashboard PoC: 1. ...

WebKit - ContainerNode::parserInsertBefore Universal Cross-Site Scripting

WebKit - ContainerNode::parserInsertBefore Universal Cross-Site Scripting Sources: https://bugs.chromium.org/p/project-zero/issues/detail?id=1146 https://bugs.chromium.org/p/chromium/issues/detail?id=519558 VULNERABILITY DETAILS From /WebKit/Source/core/dom/ContainerNode.cpp: ---------------- voi...

WebKit - 'enqueuePageshowEvent' / 'enqueuePopstateEvent' Universal Cross-Site Scripting

view-frame.page; frame.tree.appendChildchildFrame-view-frame; childFrame-open; enqueuePageshowEventPageshowEventPersisted; HistoryItem historyItem = frame.loader.history.currentItem; if historyItem && historyItem-stateObject mdocument-enqueuePopstateEventhistoryItem-stateObject;...

WebKit - ContainerNode::parserInsertBefore Universal Cross-Site Scripting Exploit

Exploit for multiple platform in category dos / poc Sources: https://bugs.chromium.org/p/project-zero/issues/detail?id=1146 https://bugs.chromium.org/p/chromium/issues/detail?id=519558 VULNERABILITY DETAILS From /WebKit/Source/core/dom/ContainerNode.cpp: ---------------- void...

Cuvva: https://admin.corp.cuvva.co/ is vulnerable to Clickjacking attacks due to missing X-Frame-Options

Description: I found the resource on https://admin.corp.cuvva.co/, which can be vulnerable to the Clickjacking. Impact The resource without X-Frame-Options potentially vulnerable to the Clickjacking. The vulnerability exist only for authenticated users possible UI redressing in the Dashboard...

PT-2017-4014

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 55 Description The issue is related to the implementation of the Content Security Policy CSP mechanism in Mozilla Firefox, specifically with the "frame-ancestors" directive. This directive's weakness can be...

Apple macOS - stackshot Raw Frame Pointers Exploit

Exploit for macOS platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1164 This is an issue that allows unentitled root to read kernel frame pointers, which might be useful in combination with a kernel memory corruption bug. By design, the syscall...

WordPress: Clickjacking wordcamp.org

Hello Security, Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking contro...

UBUNTU-CVE-2017-2549

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS UXSS attacks via a crafted web site that improperly...

CVE-2017-2549

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS UXSS attacks via a crafted web site that improperly...

CVE-2017-2549: Improper Neutralization of Input During Web Page Generation

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS UXSS attacks via a crafted web site that improperly...

PT-2017-15442

Name of the Vulnerable Software and Affected Versions iOS versions prior to 10.3.2 Safari versions prior to 10.1.1 tvOS versions prior to 10.2.1 Description The issue involves the WebKit component and allows remote attackers to conduct Universal XSS UXSS attacks via a crafted web site that...

Apple macOS - 'stackshot' Raw Frame Pointers

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1164 This is an issue that allows unentitled root to read kernel frame pointers, which might be useful in combination with a kernel memory corruption bug. By design, the syscall stacksnapshotwithconfig permits unentitled root to du...

Apple macOS - stackshot Raw Frame Pointers

Apple macOS - stackshot Raw Frame Pointers Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1164 This is an issue that allows unentitled root to read kernel frame pointers, which might be useful in combination with a kernel memory corruption bug. By design, the syscall...

schoolspring.com XSS vulnerability

Vulnerable URL: https://www.schoolspring.com/login/modal-loginframe.cfm?jid=%22%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 25342 VIP...

BSA-2017-279

Security Advisory ID : BSA-2017-279 Component : JBOSS Revision : 2.0: Interim The Management Console in Red Hat Enterprise Application Platform before 6.4.4 andWildFlyformerlyJBossApplication Server does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduc...