Sun Java System Identity Manager 6.0/7.0/7.1 /idm/help/index.jsp helpUrl Variable Remote Frame Injection

No description provided by source. source: http://www.securityfocus.com/bid/27214/info Sun Java System Identity Manager is prone to multiple input-validation vulnerabilities, including an HTML-injection issue and cross-site scripting issues, because it fails to adequately sanitize user-supplied...

Internet Explorer 4.0/5.0/5.5 preview/5.0.1 - DocumentComplete() Cross Frame Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1224/info The DocumentComplete function in IE does not properly validate origin domains. Therefore it is possible for a remote webserver to gain read access to local files on the machine of any website visitor or email...

netty: DoS via memory exhaustion during data aggregation

A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service...

Factlink: Click-Jacking due to missing X-frame header

Hey there I found out that you have missing X-frame header which allows click jacking in your website...

WordPress Walk Score Plugin <= 0.5.5 - Multiple XSS

Because of these vulnerabilities in frame-maker.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

MGASA-2014-0264 Updated wireshark packages fix CVE-2014-4020

Updated wireshark packages fix security vulnerabilities: The frame metadissector could crash CVE-2014-4020...

Updated wireshark packages fix CVE-2014-4020

Updated wireshark packages fix security vulnerabilities: The frame metadissector could crash CVE-2014-4020...

DEBIAN-CVE-2014-4020

The dissectframe function in epan/dissectors/packet-frame.c in the frame metadissector in Wireshark 1.10.x before 1.10.8 interprets a negative integer as a length value even though it was intended to represent an error condition, which allows remote attackers to cause a denial of service...

UBUNTU-CVE-2014-4020

The dissectframe function in epan/dissectors/packet-frame.c in the frame metadissector in Wireshark 1.10.x before 1.10.8 interprets a negative integer as a length value even though it was intended to represent an error condition, which allows remote attackers to cause a denial of service...

CVE-2014-4020

The dissectframe function in epan/dissectors/packet-frame.c in the frame metadissector in Wireshark 1.10.x before 1.10.8 interprets a negative integer as a length value even though it was intended to represent an error condition, which allows remote attackers to cause a denial of service...

PT-2014-5803

Name of the Vulnerable Software and Affected Versions NICE Recording eXpress versions prior to 6.5.5 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the USRLNM parameter to "myaccount/mysettings.edit.validate.asp" or the frame paramet...

PT-2014-1765

Name of the Vulnerable Software and Affected Versions Wireshark versions 1.10.x through 1.10.7 Description The issue arises from the interpretation of negative integers as length values in the dissect frame function, located in epan/dissectors/packet-frame.c, within the frame metadissector of...

openSUSE Security Update : seamonkey (seamonkey-5210)

Mozilla SeaMonkey was updated to version 2.4, fixing various bugs and security issues. MFSA 2011-36: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption...

openSUSE Security Update : chromium (openSUSE-SU-2014:0327-1)

Chromium was updated to 33.0.1750.117 Stable channel update : - Security Fixes : - CVE-2013-6653: Use-after-free related to web contents - CVE-2013-6654: Bad cast in SVG - CVE-2013-6655: Use-after-free in layout - CVE-2013-6656: Information leak in XSS auditor - CVE-2013-6657: Information leak in...

IBM Tivoli Directory Server 6.0.x / 6.1 < 6.1.0.58 / 6.2 < 6.2.0.33 / 6.3 < 6.3.0.25 Javadoc Frame Injection

According to its version, the installation of IBM Tivoli Directory Server on the remote host is 6.0.x or 6.1 6.1.0.58 / 6.2 6.2.0.33 / 6.3 6.3.0.25. It is, therefore, affected by an error related to the included Java version and input-validation that allows an attacker to inject HTML frames into...

UBUNTU-CVE-2014-1346

WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, does not properly interpret Unicode encoding, which allows remote attackers to spoof a postMessage origin, and bypass intended restrictions on sending a message to a connected frame or window, via crafted characters in a URL...

CVE-2014-1748

The vulnerability CVE-2014-1748 affects Blink in Google Chrome prior to 35.0.1916.114. It targets ScrollView::paint in platform/scroll/ScrollView.cpp, allowing a remote attacker to spoof the UI by extending scrollbar painting into the parent frame. Impact: UI spoofing could mislead users. Affecte...

CVE-2014-1748

Removed by vendor...

Updated python-django package fix two vulnerabilities

Updated python-django and python-dgango14 packages fix security vulnerabilities: Stephen Stewart, Michael Nelson, Natalia Bidart and James Westby discovered that Django improperly removed Vary and Cache-Control headers from HTTP responses when replying to a request from an Internet Explorer or...

USN-2212-1 python-django vulnerabilities

Stephen Stewart, Michael Nelson, Natalia Bidart and James Westby discovered that Django improperly removed Vary and Cache-Control headers from HTTP responses when replying to a request from an Internet Explorer or Chrome Frame client. An attacker may use this to retrieve private data or poison...