chromium-browser: script injection in devtools

Cross-site scripting XSS vulnerability in the Developer Tools aka DevTools subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allows remote attackers to inject arbitrary web script or HTML via the settings parameter in a...

Arbitrary Code Execution in extension "Frontend User Registration" (sf_register)

Release Date: September 12, 2016 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 6.2.8 and below Vulnerability Type: Arbitrary Code Execution Severity: High Suggested CVSS v2.0:...

CVE-2016-5165

Cross-site scripting XSS vulnerability in the Developer Tools aka DevTools subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allows remote attackers to inject arbitrary web script or HTML via the settings parameter in a...

UBUNTU-CVE-2016-5165

Cross-site scripting XSS vulnerability in the Developer Tools aka DevTools subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allows remote attackers to inject arbitrary web script or HTML via the settings parameter in a...

TYPO3 Frontend Login SQL Injection Vulnerability

TYPO3 is a free and open source content management system maintained by the Swiss TYPO3 Association. A SQL injection vulnerability exists in TYPO3 Frontend Login. Because the application fails to adequately filter user-supplied data before being used in SQL queries, an attacker could exploit the...

Hdcms framework foreground wd parameter has SQL injection vulnerability

HDCMS is a content management system package written in PHP. A SQL injection vulnerability exists in the frontend wd parameter of the hdcms framework, due to the program failing to adequately filter the wd parameter and only doing the corresponding code audit on the source code. An attacker is...

chromium-browser: Parameter sanitization failure in DevTools

The Developer Tools aka DevTools subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different...

TYPO3 Frontend Login SQL Injection Vulnerability (Jul 2016)

TYPO3 is prone to an sql injection vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3"; ifdescription...

SQL Injection in TYPO3 Frontend Login

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-016...

SQL Injection in TYPO3 Frontend Login

It has been discovered, that TYPO3 is susceptible to SQL Injection. Component Type: TYPO3 CMS Release Date: July 19, 2016 Vulnerable subcomponent: Frontend Login Vulnerability Type: SQL Injection Affected Versions: Versions 6.2.0 to 6.2.25 and 7.6.0 to 7.6.9 Severity: Medium Suggested CVSS v2.0:...

Cache Flooding in TYPO3 Frontend

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-022...

Google Chrome Access Restriction Bypass

The vulnerability of the WebKit/Source/devtools/frontend/devtools.js module of the Developer Tools subsystem in the Google Chrome browser’s Blink component arises from the lack of a guarantee that the parameter remoteFrontendUrl will correspond to the address chrome-devtools-frontend.appspot.com...

Google Chrome Access Restriction Bypass Vulnerability (CNVD-2016-03836)

Google Chrome is a web browsing tool developed by Google. In versions of Google Chrome prior to 51.0.2704.79, Blink/DevTools/WebKit/Source/devtools/frontend/devtools.js does not ensure that the remoteFrontendUrl parameter is associated with the chrome-devtools- frontend.appspot.com URL associatio...

UBUNTU-CVE-2016-1699

WebKit/Source/devtools/frontend/devtools.js in the Developer Tools aka DevTools subsystem in Blink, as used in Google Chrome before 51.0.2704.79, does not ensure that the remoteFrontendUrl parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to...

CVE-2016-1699

WebKit/Source/devtools/frontend/devtools.js in the Developer Tools aka DevTools subsystem in Blink, as used in Google Chrome before 51.0.2704.79, does not ensure that the remoteFrontendUrl parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to...

chromium-browser: parameter sanitization failure in devtools

WebKit/Source/devtools/frontend/devtools.js in the Developer Tools aka DevTools subsystem in Blink, as used in Google Chrome before 51.0.2704.79, does not ensure that the remoteFrontendUrl parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to...

Open-Xchange OX AppSuite 7.8.0 XSS / Open Redirect

Product: OX AppSuite Vendor: Open-Xchange GmbH Internal reference: 44542 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.8.0 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed versions: 7.6.2-rev40, 7.6.3-rev...

[SECURITY] Fedora 23 Update: cacti-0.8.8h-1.fc23

Cacti is a complete frontend to RRDTool. It stores all of the necessary information to create graphs and populate them with data in a MySQL database. The frontend is completely PHP driven...

WordPress WP User Frontend Plugin Unlimited File Upload Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. Unlimited file upload vulnerability exists in WordPress WP User Frontend plugin versions prior to 2.3.11. Allows an attacker ...

CVE-2015-8550

Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service host OS crash or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability...