CVE-2017-3967

CVE-2017-3967 affects McAfee Network Security Management (NSM) web interface prior to version 8.2.7.42.2. The issue is a framing vulnerability that allows a remote attacker to inject arbitrary web script or HTML by breaking out of third‑party frames in application pages. Documents consistently de...

CVE-2017-3967 SB10192 - Network Security Management (NSM) - Target influence via framing vulnerability

Target influence via framing vulnerability in the web interface in McAfee Network Security Management NSM before 8.2.7.42.2 allows remote attackers to inject arbitrary web script or HTML via application pages inability to break out of 3rd party HTML frames...

CVE-2017-18088

Various plugin servlet resources in Atlassian Bitbucket Server before version 5.3.7 the fixed version for 5.3.x, from version 5.4.0 before 5.4.6 the fixed version for 5.4.x, from version 5.5.0 before 5.5.6 the fixed version for 5.5.x, from version 5.6.0 before 5.6.3 the fixed version for 5.6.x,...

correctionenterprises.com XSS vulnerability

Open Bug Bounty ID: OBB-549403 Description| Value ---|--- Affected Website:| correctionenterprises.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Legal Robot: Clickjacking in Legalrobot app

Dear Team, POC Please find attached screenshots Steps to reproduce: create index.html file with following content: Open index.html in browser Actual result: Legalrobot email verification page is viewed in iframe. Remediation: Frame busting technique is the better framing protection technique...

CVE-2017-7667

Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin...

CVE-2017-7667

CVE-2017-7667 affects Apache NiFi versions prior to 0.7.4 and 1.x prior to 1.3.0. The issue is an Origin Validation/Framing problem where NiFi did not set a suitable X-Frame-Options header, leaving the application vulnerable to cross-frame framing attacks. Connected advisories (GHSA/JQ99, CNVD/CN...

openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2017-629)

This update for java-170-openjdk fixes the following issues : - Update to 2.6.10 - OpenJDK 7u141 bsc1034849 - Security fixes - S8163520, CVE-2017-3509: Reuse cache entries - S8163528, CVE-2017-3511: Better library loading - S8165626, CVE-2017-3512: Improved window framing - S8167110, CVE-2017-351...

WordPress Magic Fields 1 plugin cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Wordpress Magic Fields 1 plugin, which allows an attacker to frame malicio...

WordPress Corner Ad Plugin Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the wordpress Corner Ad plugin, which allows attackers to frame malicious web...

wordpress plugin event-notifier cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the wordpress plugin event-notifier, which allows attackers to frame malicious...

wordpress plugin keywords-to-amazon-links cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the wordpress plugin keywords-to-amazon-links, which allows an attacker to fra...

Cross-site scripting vulnerability in wordpress plugin tagmaker

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. The wordpress plugin tagmaker suffers from a cross-site scripting vulnerability due to improper filtering of user input, whic...

Cross-site scripting vulnerability in wordpress plugin tinyfier-wp

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. The wordpress plugin tinyfier-wp suffers from a cross-site scripting vulnerability due to improper filtering of user input,...

Cross-site scripting vulnerability in wordpress plugin prettypre

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. The wordpress plugin prettypre suffers from a cross-site scripting vulnerability due to improper filtering of user input, whi...

wordpress plugin front-end-post-edit cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the wordpress plugin front-end-post-edit, which allows an attacker to frame...

wordpress plugin funny-branding cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the wordpress plugin funny-branding, which allows an attacker to frame malicio...

wordpress plugin Germany-likes-opt-in-facebook cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. The wordpress plugin Germany-likes-opt-in-facebook suffers from an xss vulnerability due to improper filtering of user input,...

wordpress plugin editionguard-for-wp-e-commerce-ebook-sales-with-drm cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the wordpress plugin editionguard-for-wp-e-commerce-ebook-sales-with-drm, whic...

Wordpress plugin sagepay-server-gateway-for-jigoshop has cross-site scripting hole

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. The Wordpress plugin sagepay-server-gateway-for-jigoshop has a cross-site scripting hole. The program fails to filter user-supplied input, allowing attackers to fra...