chromium-browser: information leak in v8

The JSGenericLowering class in compiler/js-generic-lowering.cc in Google V8, as used in Google Chrome before 50.0.2661.94, mishandles comparison operators, which allows remote attackers to obtain sensitive information via crafted JavaScript code...

Regular Expression Denial Of Service

Overview Affected versions of uri-js is susceptible to a regular expression denial of service vulnerability when user input is sent to the .parse method. Recommendation Update to v3.0.0 or later. References - Issue 12 - GitHub Advisory...

DEBIAN-CVE-2016-2086

Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header...

Recent js blackmailer anti-killing skills analysis-vulnerability warning-the black bar safety net

Recently many users reflect the computer in a blackmailer virus, also known as the“Locky ransomware”, the computer in documents, pictures and other important information is virus encryption. Such viral vectors for the js script by js script download remote server of the pe file, and that this pe...

BookBox German - External URLs, WebView JavaScript enabled, WebView files access vulnerabilities

HackApp vulnerability scanner discovered that application BookBox German published at the 'play' market has multiple vulnerabilities...

Insecure Default Configuration

Overview Affected versions of airbrake default to sending environment variables over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible for them to capture and read these environment variables, which may result in leaking sensitive...

CVE-2016-2561

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.5 and 4.5.x before 4.5.5.1 allow remote authenticated users to inject arbitrary web script or HTML via 1 normalization.php or 2 js/normalization.js in the database normalization page, 3...

CVE-2016-2561: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.5 and 4.5.x before 4.5.5.1 allow remote authenticated users to inject arbitrary web script or HTML via 1 normalization.php or 2 js/normalization.js in the database normalization page, 3...

PT-2016-5208

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.4.x through 4.4.15.4 phpMyAdmin versions 4.5.x through 4.5.5.0 Description The issue allows remote authenticated users to inject arbitrary web script or HTML. This can be achieved via several pages, including the database...

WordPress User Submitted Posts 20151113 Cross Site Scripting

Exploit Title: WordPress User Submitted Posts Plugin Persistent XSS Discovery Date: 2016-02-10 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: https://plugin-planet.com/ Software Link: https://wordpress.org/plugins/user-submitted-posts/ Version:...

CVE-2016-1927

The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach...

CVE-2016-2043

Cross-site scripting XSS vulnerability in the goToFinish1NF function in js/normalization.js in phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a table name to the normalization page...

CVE-2016-1927: Undefined Security Weakness

The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach...

PT-2016-4984

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.4.x through 4.4.15.2 phpMyAdmin versions 4.5.x through 4.5.3 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via a table name to the normalization page. This is due to a...

CVE-2016-2043: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the goToFinish1NF function in js/normalization.js in phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a table name to the normalization page...

PT-2016-4025

Name of the Vulnerable Software and Affected Versions Apache Solr versions prior to 5.1 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the Admin UI. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via crafted fields that are...

CVE-2015-8795: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Admin UI in Apache Solr before 5.1 allow remote attackers to inject arbitrary web script or HTML via crafted fields that are mishandled during the rendering of the 1 Analysis page, related to webapp/web/js/scripts/analysis.js or 2...

PT-2016-4026

Name of the Vulnerable Software and Affected Versions Apache Solr versions prior to 5.3 Description A cross-site scripting XSS issue exists in the Admin UI, specifically in the webapp/web/js/scripts/schema-browser.js file, allowing remote attackers to inject arbitrary web script or HTML via a...

Zomato: Persistent input validation mail encoding vulnerability in the "just followed you" email notification.

This vulnerability allows an attacker to add custom html/js code to emails that are then sent to other users of zomato.com. This vulnerability can be reproduced by any normal user ie. unprivileged accounts by editing their profile's "your full name" field with malicious code. This is not possible...

Sola Support Ticket <= 3.12 - XSS & Configuration Change

Any logged in user with any role and access to wp-admin in any way can update plugin settings including allowing HTML to be parsed. One can also change any notification messages to include JS which then can be used to obtain information by forgery. PoC Make POST request to /wp-admin with paramete...