23359 matches found
Cisco AnyConnect Secure Mobility Client for Windows SBL Privileges Escalation Vulnerability
A vulnerability in the Start Before Logon SBL module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local attacker to open Internet Explorer with the privileges of the SYSTEM user. The vulnerability is due to insufficient implementation of the acce...
CVE-2017-3823
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Firefox, the GpcContainer Class ActiveX control plugin before 10031.6.2017.0126 on Internet Explorer, and the Download Manager ActiveX control plugin...
Cisco WebEx for Internet Explorer RCE (cisco-sa-20170124-webex)
The Cisco WebEx Extension for Internet Explorer installed on the remote host is affected by a remote code execution vulnerability due to a crafted pattern that permits any URL utilizing it to automatically use native messaging to access sensitive functionality provided by the extension. An...
Cisco WebEx web browser extension allows arbitrary code execution
Overview The Cisco WebEx extensions for Chrome, Firefox, and Internet Explorer allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable Windows system. Description Cisco WebEx is a suite of online meeting software. WebEx meetings are usually joined through a web browser...
The vulnerability of the Internet Explorer browser allows a perpetrator to obtain confidential information from the process memory.
The vulnerability of the Internet Explorer browser is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain confidential information from the process’s memory through a specially crafted web page...
Vulnerability of browsers Internet Explorer and Microsoft Edge, allowing hackers to circumvent existing access restrictions policies
The vulnerability of Internet Explorer and Microsoft Edge is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to bypass existing access control policies using uncertain vectors...
Vulnerability of browsers Internet Explorer and Microsoft Edge, allowing attackers to inject arbitrary Web or HTML code
The vulnerabilities of Internet Explorer and Microsoft Edge exist due to the lack of measures taken to protect the structure of web pages. Exploiting these vulnerabilities allows a malicious actor to inject arbitrary Web or HTML code using undefined vectors...
January 26, 2017—KB 3216755 (OS Build 14393.726)
None None...
The vulnerability of the Internet Explorer browser, which allows a violator to trigger a service failure or execute arbitrary code
The vulnerability of the Internet Explorer browser arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failure memory corruption by using a specially crafted web page...
The vulnerability of the Internet Explorer browser allows a perpetrator to obtain confidential information from the process memory.
The vulnerability of the Internet Explorer browser is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain confidential information from the process’s memory through a specially crafted web page...
The vulnerabilities of browsers Internet Explorer and Microsoft Edge allow attackers to trigger service failures or execute arbitrary code.
The vulnerability of Internet Explorer and Microsoft Edge arises from operations that go beyond the buffer limits in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failure memory corruption by using a specially crafted web page...
Cisco WebEx Browser Extension Remote Code Execution Vulnerability
A vulnerability in Cisco WebEx browser extensions could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulnerability affects the browser extensions for Cisco WebEx Meetings Server and Cisco WebEx Centers...
Ubiquiti Inc.: [nutty.ubnt.com] DOM Based XSS nuttyapp github-btn.html
Description === Vulnerable parameter: user Vulnerable script: http://nutty.ubnt.com/github-btn.html Vulnerable code: js var params = function var vars = , hash; var hashes = window.location.href.slicewindow.location.href.indexOf'?' + 1.split'&'; forvar i = 0; i HTMLHTMLHTMLHTMLHTMLHTML&type=follo...
Microsoft Dynamics CRM 2011 Update Rollup 17
Microsoft Dynamics CRM 2011 Update Rollup 17 INTRODUCTION Update Rollup 17 for Microsoft Dynamics CRM 2011 is available. This article describes the hotfixes and updates that are included in this update rollup. This update rollup is available for all languages that are supported by Microsoft...
Adobe Flash Player 24.0.0.186 - ActionGetURL2 Out-of-Bounds Memory Corruption (2)
Adobe Flash Player 24.0.0.186 - ActionGetURL2 Out-of-Bounds Memory Corruption 2 Source: https://cosig.gouv.qc.ca/en/cosig-2017-01-en/ Application: Adobe Flash Player Platforms: Windows,OSX Versions: 24.0.0.186 and earlier Author: Francis Provencher of COSIG Website:...
Airbnb: [airbnb.com] XSS via Cookie flash
By corrupting the value of a cookie on the airbnb.com domain, bobrov was able to execute an XSS payload. Because cookies cannot be set cross-domain, this did require another vulnerability to be exploitable. Furthermore, because of CSP, this was only exploitable in Internet Explorer 11. The issue...
Airbnb: [m.airbnb.com] CRLF Injection
By using a URL-escaped character sequence, bobrov was able to inject HTTP headers into the responses of some redirects on the m.airbnb.com domain. This allowed them to perform actions such as setting cookies for the airbnb.com domain. This primarily affected Internet Explorer, and was not...
Internet Explorer Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain. In a web-based attack scenario, an attacker could host a website that is us...