CVE-2018-5172

The Live Bookmarks page and the PDF viewer can run injected script content if a user pastes script from the clipboard into them while viewing RSS feeds or PDF files. This could allow a malicious site to socially engineer a user to copy and paste malicious script content that could then run with t...

TeX Live Parameter Injection Vulnerability

TeX Live is an international TeX user organization TUG developed a set of TeX electronic typesetting system. The system provides typesetting language, macro definition and other functions. A security vulnerability exists in TeX Live 20170524 and earlier versions, which stems from the program...

live-timing.com XSS vulnerability

Open Bug Bounty ID: OBB-628675 Description| Value ---|--- Affected Website:| live-timing.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

WebSocket Live Chat Cross-Site Scripting Vulnerability

WebSocket Live Chat is an instant messaging script that allows you to create groups and send individual messages. It is suitable for social messaging and live support systems. A cross-site scripting vulnerability exists in WebSocket Live Chat. An attacker could execute arbitrary code in a user's...

Talos Threat Research Summit Guide and Cisco Live Preview

The first Cisco Talos Threat Research Summit is coming up at Cisco Live! in Orlando, so we are providing a quick guide to all the activities going on at the summit and beyond. The response to the summit was stronger than we could have anticipated for the first year - it sold out fast! Next time, ...

SUSE-SU-2018:1514-1 Security update for the Linux Kernel (Live Patch 17 for SLE 12 SP1)

This update for the Linux Kernel 3.12.74-606448 fixes several issues. The following security issues were fixed: - CVE-2017-13166: An elevation of privilege vulnerability in the kernel v4l2 video driver was fixed. bsc1085447. - CVE-2018-8897: A statement in the System Programming Guide of the Inte...

Mozilla Firefox Design Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in the Live Bookmark page and PDF reader in versions of Mozilla Firefox prior to 60. A remote attacker can exploit this vulnerability by performing a social...

Security fix for the ALT Linux 10 package firefox-esr version 60.0.1-alt1

June 5, 2018 Andrey Cherepanov 60.0.1-alt1 - New ESR version 60.0.1. - Fixed: + CVE-2018-5154: Use-after-free with SVG animations and clip paths + CVE-2018-5155: Use-after-free with SVG animations and text paths + CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files +...

Design/Logic Flaw

product-monitor is a HTML/JavaScript template for monitoring a product by encouraging product developers to gather all the information about the status of a product, including live monitoring, statistics, endpoints, and test results into one place. product-monitor versions below 2.2.5 download...

Teradek Cube 7.3.6 (snapshot.cgi) Stream Disclosure

Teradek Cube 7.3.6 snapshot.cgi Stream Disclosure Vendor: Teradek, LLC Product web page: https://www.teradek.com Affected version: Firmware Version: 7.3.6 build 26850 Hardware Version: 1.5 Teradek Firmware Version 7.3.15 Summary: Cube packs world-class video quality into a rugged, portable chassi...

Teradek VidiU Pro 3.0.3 (snapshot.cgi) Stream Disclosure

Teradek VidiU Pro 3.0.3 snapshot.cgi Stream Disclosure Vendor: Teradek, LLC Product web page: https://www.teradek.com Affected version: VidiU, VidiU Mini, VidiU Pro 3.0.3r32136 3.0.2r31225 2.4.10 Summary: The Teradek VidiU gives you the freedom to broadcast live high definition video directly to...

WebSocket Live Chat Cross Site Scripting

Exploit Title: WebSocket Live Chat - Cross-Site Scripting Date: 2018-05-22 Exploit Author: Alireza Norkazemi Vendor Homepage: https://codecanyon.net/item/websocket-live-chat-instant-messaging-php/16545798?srank=1 POC : 1 Create your account and click setting icon and go to profile 2 Put this...

Teradek Slice 7.3.15 (snapshot.cgi) Stream Disclosure

Teradek Slice 7.3.15 snapshot.cgi Stream Disclosure Vendor: Teradek, LLC Product web page: https://www.teradek.com Affected version: Firmware Version:7.3.15 build 31735 Hardware Version: 2.1 Summary: Built on the award-winning Cube platform, Slice is a rack mount HEVC / H.264 codec designed to fi...

WebSocket Live Chat - Cross-Site Scripting

WebSocket Live Chat - Cross-Site Scripting Exploit Title: WebSocket Live Chat - Cross-Site Scripting Date: 2018-05-22 Exploit Author: Alireza Norkazemi Vendor Homepage: https://codecanyon.net/item/websocket-live-chat-instant-messaging-php/16545798?srank=1 POC : 1 Create your account and click...

Teradek VidiU Pro 3.0.3 - Cross-Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications input type="hidden" name="pw...

WebSocket Live Chat - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: WebSocket Live Chat - Cross-Site Scripting Exploit Author: Alireza Norkazemi Vendor Homepage: https://codecanyon.net/item/websocket-live-chat-instant-messaging-php/16545798?srank=1 POC : 1 Create your account and click setting...

WebSocket Live Chat - Cross-Site Scripting

Exploit Title: WebSocket Live Chat - Cross-Site Scripting Date: 2018-05-22 Exploit Author: Alireza Norkazemi Vendor Homepage: https://codecanyon.net/item/websocket-live-chat-instant-messaging-php/16545798?srank=1 POC : 1 Create your account and click setting icon and go to profile 2 Put this...

Vote for Malwarebytes Labs: European Security Blogger Awards 2018

It's nearly time for Infosec Europe 2018, and that means it's also time to consider voting for your favourite security blogs, podcasts, video channels, and more for the upcoming European Security Blogger Awards. Thanks to your generous votes, we've been fortunate enough to pick up the award for...

Airpydump - Analyze Wireless Packets On The Fly. Currently Supporting Three Working Modes (Reader, Live, Stealth)

Analyze Wireless Packets on the fly. Currently supporting three working Modes Reader, Live, Stealth Description airpydump is a wireless packet analyzer, providing the interface most likely that of airodump-ng from aircrack suite. It currently provides three working modes which are Reader, Stealth...

Teradek VidiU Pro 3.0.3 - Server-Side Request Forgery

Teradek VidiU Pro 3.0.3 SSRF Vulnerability Vendor: Teradek, LLC Product web page: https://www.teradek.com Affected version: VidiU, VidiU Mini, VidiU Pro 3.0.3r32136 3.0.2r31225 2.4.10 Summary: The Teradek VidiU gives you the freedom to broadcast live high definition video directly to the Web...