CVE-2016-6842

Open-Xchange OX App Suite prior to 7.8.2-rev8 contains a cross-site scripting issue in which setting a user’s name to JavaScript code causes that code to execute when the victim accesses the user’s shared Templates folder via OX Documents. The attack requires the folder to be shared to the victim...

CVE-2016-9651

A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...

JS Jobs,1.1.5 and all previous,SQL Injection

JS Jobs,1.1.5 and all previous,SQL Injection Resolution: update to version 1.1.6 Update notice: https://www.joomsky.com/products/js-jobs.htmlfive...

Downloads Resources over HTTP

Overview Affected versions of js-given insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on...

Downloads Resources over HTTP

Overview Affected versions of arrayfire-js insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution...

Netease open source Pomelo game server framework is not authorized to access leads to remote command execution

Pomelo is a piece of Netease open source based on Node.js the game server framework, which is based on Node.js high-performance, distributed game server framework. It includes the basis of the development framework and the associated expansion components, libraries and tools packages, can help sa...

IBM SDK for Node.js Denial of Service Vulnerability

IBM SDK for Node.js is a set of U.S. IBM based on the Node.js open source project and for the IBM platform to provide an independent JavaScript runtime environment and server-side JavaScript solutions . A local denial of service vulnerability exists in IBM SDK for Node.js. An attacker could explo...

OwnCloud Server and Nextcloud Server Cross-Site Scripting Vulnerabilities

OwnCloud is a free and open source personal cloud storage solution from OwnCloud Germany.Nextcloud is an open source self-hosted file synchronization and sharing communication application platform.OwnCloud Server and Nextcloud Server are both a server version of one of them. A cross-site scriptin...

Open-Xchange App Suite 7.8.2 - Cross-Site Scripting

Product: OX App Suite Vendor: OX Software GmbH Internal reference: 46484 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.8.2 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.6.2-rev46, 7.6.3-rev1...

Open-Xchange App Suite 7.8.2 - Cross Site Scripting

Exploit for cgi platform in category web applications Product: OX App Suite Vendor: OX Software GmbH Internal reference: 46484 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.8.2 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status:...

Open-Xchange App Suite 7.8.2 Cross Site Scripting

Product: OX App Suite Vendor: OX Software GmbH Internal reference: 46484 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.8.2 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.6.2-rev46, 7.6.3-rev1...

SSRF Vulnerability in OpenSNS Social System

OpenSNS is a lightweight social user-centered framework based on OneThink for ... An SSRF vulnerability exists in /Public/js.php in OpenSNS Social System due to the program failing to adequately filter data. An attacker is allowed to exploit the vulnerability to probe intranet information...

[SECURITY] Fedora 23 Update: kf5-khtml-5.24.0-1.fc23

KHTML is a web rendering engine, based on the KParts technology and using K JS for JavaScript support...

[SECURITY] Fedora 24 Update: kf5-khtml-5.24.0-1.fc24

KHTML is a web rendering engine, based on the KParts technology and using K JS for JavaScript support...

DOM-based XSS

Overview Affected versions of gmail-js are vulnerable to cross-site scripting in the tools.parseresponse, helper.get.visibleemailspost, and helper.get.emaildatapost functions, which pass user input directly into the Function constructor. Recommendation Update to version 0.6.5 or later. References...

js-php.ru Open Redirect vulnerability

Vulnerable URL: http://js-php.ru/go.php?to=http://www.openbugbounty.org Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 10:56 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 4312286 VIP website...

Memory corruption

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3265...

Suspicious Webpage JavaScript Downloader

Certain malicious executable files can be hidden using js downloader file. A remote attacker could exploit this vulnerability to entice unsuspecting users to execute arbitrary files...

MS15-1 0 6 JavaScript ArrayBuffer. slice any address read-vulnerability analysis-vulnerability warning-the black bar safety net

2 0 1 5 year 8 month 1 3 day, Microsoft released the Update Patch security bulletin MS15-1 0 6, which contains the About Internet Explorer multiple vulnerabilities. Before, we have explained how to attack the VBScript engine inside the Filter function in the presence of type confusion...

Microsoft Internet Explorer XSS Filter Bypass (MS16-063: CVE-2016-3212)

A remote code execution vulnerability exists in Microsoft Internet Explorer. The vulnerability is due to the way the JS prevents an object from loading. A remote attacker can exploit this issue by enticing a user to open a specific web-page with a relevant query on an affected version of Internet...