12100 matches found
CVE-2016-1709
Removed by vendor...
UBUNTU-CVE-2016-5130
content/renderer/historycontroller.cc in Google Chrome before 52.0.2743.82 does not properly restrict multiple uses of a JavaScript forward method, which allows remote attackers to spoof the URL display via a crafted web site...
Uber: Can add employee in business.uber.com without add payment method
Dear Uber, I found that modify html from https://business.uber.com/organization/org-id/employees can make I create employee without adding payment method. Step to reproduce: 1. Edit html, remove overlay alert. 2. Create employee in website. Or: Use post form: POST...
OpenJDK: incorrect handling of MethodHandles.dropArguments() argument (Libraries, 8155985)
Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3610...
CVE-2016-1709
Heap-based buffer overflow in the ByteArray::Get method in data/bytearray.cc in Google sfntly before 2016-06-10, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SFNT font...
CVE-2016-5130
content/renderer/historycontroller.cc in Google Chrome before 52.0.2743.82 does not properly restrict multiple uses of a JavaScript forward method, which allows remote attackers to spoof the URL display via a crafted web site...
The vulnerability of the Apache Struts software platform, which allows attackers to circumvent existing access restrictions
The vulnerability of the Apache Struts software platform exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to circumvent existing access restrictions by using the default method...
OpenJDK: incorrect access control context used in DGCImpl (RMI, 8080688)
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4883...
OpenJDK: unrestricted deserialization of authentication credentials (JMX, 8144430)
It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger...
JDK: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 6.0.16.25, 6 R1 before SR8 FP25 6.1.8.25, 7 before SR9 FP40 7.0.9.40, 7 R1 before SR3 FP40 7.1.3.40, and 8 before SR3 8.0.3.0 uses the invoke method of the java.lang.reflect.Method class in an...
OpenJDK: insufficient proxy class checks in RemoteObjectInvocationHandler (RMI, 8076339)
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to RMI...
July 12, 2016 — KB3163912 (OS Build 10240.17024)
None None...
WordPress < 4.5.2 Multiple Vulnerabilities (ImageTragick)
Binary data 9387.prm...
The vulnerability of Thunderbird software, which allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information.
The use of this function after release in nsDocLoader::OnProgress in Mozilla Firefox, Firefox ESR, and Thunderbird allows malicious actors who operate remotely to execute arbitrary code, triggering the FireOnStateChange event...
The vulnerability of the implementation of the getClass method in the CookieInterceptor class of the Apache Struts software framework allows a hacker to execute arbitrary code.
The vulnerability of the CookieInterceptor class implementation in the Apache Struts software platform is related to deficiencies in access control when processing the cookiesName value with a placeholder. Exploiting this vulnerability could allow an attacker to execute arbitrary code by sending ...
The vulnerability of the implementation of the getClass method in the CookieInterceptor class of the Apache Struts software framework allows a hacker to gain access to read, modify, or delete data.
The vulnerability of the CookieInterceptor class implementation in the Apache Struts software platform is related to deficiencies in access control when processing the cookiesName parameter with the symbol “”. Exploiting this vulnerability can allow an attacker to gain access to, read, modify, or...
The vulnerability of the Firefox browser, which allows a malicious actor to circumvent window object restrictions
The Mozilla Firefox browser contains a vulnerability related to incompatibility between JavaScript components. Exploiting this vulnerability allows malicious actors to bypass window object restrictions by utilizing incompatibility in the original method-implementations of various JavaScript engin...
The vulnerability of the Firefox ESR browser allows a malicious individual to circumvent window object restrictions.
The Mozilla Firefox ESR browser contains a vulnerability related to incompatibility with JavaScript software components. Exploiting this vulnerability allows malicious actors to bypass window object restrictions by utilizing incompatibility in the original method-extractors of various JavaScript...
Default configuration
Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method...
