4751 matches found
CVE-2016-6842
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Setting the user's name to JS code makes that code execute when selecting that user's "Templates" folder from OX Documents settings. This requires the folder to be shared to the victim. Malicious script code can be executed...
Mozilla Firefox ESR 45.x < 45.6 Multiple Vulnerabilities
The version of Mozilla Firefox ESR installed on the remote Windows host is 45.x prior to 45.6. It is, therefore, affected by the following vulnerabilities : - Multiple memory corruption issues exist, such as when handling document state changes or HTML5 content, or else due to dereferencing alrea...
Mozilla Firefox ESR 45.x < 45.6 Multiple Vulnerabilities (macOS)
The version of Mozilla Firefox ESR installed on the remote macOS or Mac OS X host is 45.x prior to 45.6. It is, therefore, affected by the following vulnerabilities : - Multiple memory corruption issues exist, such as when handling document state changes or HTML5 content, or else due to...
Cross-site Scripting (XSS)
Grails-core is vulnerable to cross-site scripting XSS attacks through the default error handler. The default error handler does not sanitize user-input values when displaying an error, allowing an attacker to inject arbitrary Javascript code into a victim's browser...
CVE-2016-8506
XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javascript code...
CVE-2016-8505
XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arbitrary javascript code...
CVE-2016-8506
XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javascript code...
CVE-2016-8505
XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arbitrary javascript code...
CVE-2016-8506
CVE-2016-8506 affects Yandex Browser for desktop, specifically the Translator component. The vulnerability is an Cross-Site Scripting flaw in Yandex Browser Translator present in versions 15.12 through 16.2, allowing a remote attacker to execute arbitrary JavaScript. No patch/version remediation ...
Pootle Server < 2.7.3 Multiple XSS Vulnerabilities
Pootle server is prone to multiple cross-site scripting XSS vulnerabilities. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...
Kmail JS Code Execution Vulnerability
KMail is a mail client for KDE that supports protocols such as IMAP and POP3. A JS code execution vulnerability exists in Kmail, which can be exploited by an attacker to execute JS code...
XSS Vulnerability in NetEase Email Master Client PC Version
NetEase Mail Master client is a universal email client launched by NetEase 163. An XSS vulnerability exists in the PC version Ver2.4.1.8 of the NetEase Mail Master client. It allows attackers to insert malicious js code into the page to obtain user cookies and other information, leading to user...
Adobe Reader and Acrobat Memory Corruption (APSB16-33: CVE-2016-6960)
A memory corruption vulnerability exists in Adobe Acrobat and Reader. The vulnerability is due to an error while loading a PDF containing a malicious JavaScript code. A remote attacker may exploit this issue by enticing a target user to open a malicious PDF file with an affected version of Adobe...
CVE-2016-5172
The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code...
Code injection
WebKit/Source/bindings/templates/interface.cpp in Blink, as used in Google Chrome before 53.0.2785.113, does not prevent certain constructor calls, which allows remote attackers to cause a denial of service use-after-free or possibly have unspecified other impact via crafted JavaScript code...
Code injection
The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code...
CVE-2016-5171
CVE-2016-5171 affects Blink in Chromium/Chrome. WebKit/Source/bindings/templates/interface.cpp does not prevent certain constructor calls, enabling a remote attacker to trigger a use-after-free via crafted JavaScript, potentially causing denial of service and unspecified other impact. Affected: B...
CVE-2016-5171
Removed by vendor...
CVE-2016-5172
The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code...