USN-3391-2 ubufox update

USN-3391-1 fixed vulnerabilities in Firefox. This update provides the corresponding update for Ubufox. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to...

Mozilla: Spoofing following page navigation with data: protocol and modal alerts (MFSA 2017-19)

On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary domains following page navigation, spoofing of the origin of the modal alert from the iframe content. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox ...

UBUNTU-CVE-2017-7783

If a long user name is used in a username/password combination in a site URL such as " http://UserName:[email protected]", the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service. This vulnerability affects Firefox 55...

CVE-2017-7783

If a long user name is used in a username/password combination in a site URL such as " http://UserName:[email protected]", the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service. This vulnerability affects Firefox 55...

UBUNTU-CVE-2017-7791

On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary domains following page navigation, spoofing of the origin of the modal alert from the iframe content. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox ...

Easy Modal <= 2.0.17 - Authenticated SQL Injection

This can only be exploited by a user who already has access to the admin with a valid nonce. During the security analysis, ThunderScan discovered SQL injection vulnerabilities in the Easy Modal WordPress Plugin. The easiest way to reproduce the vulnerability is to visit the provided URL while bei...

Easy Modal <= 2.0.17 - Authenticated SQL Injection

This can only be exploited by a user who already has access to the admin with a valid nonce. During the security analysis, ThunderScan discovered SQL injection vulnerabilities in the Easy Modal WordPress Plugin. The easiest way to reproduce the vulnerability is to visit the provided URL while bei...

WordPress Easy Modal 2.0.17 SQL Injection

DefenseCode ThunderScan SAST Advisory WordPress Easy Modal Plugin Multiple Security Vulnerabilities Advisory ID: DC-2017-01-007 Advisory Title: WordPress Easy Modal Plugin Multiple Vulnerabilities Advisory URL: http://www.defensecode.com/advisories.php Software: WordPress Easy Modal plugin...

WordPress Easy Modal plugin <=2.0.17 - SQL Injection vulnerability

SQL Injection vulnerability found in Easy Modal WordPress plugin version 2.0.17 and earlier versions by Neven Biruski DefenseCode. Possible if a user with administrator rights tricked to follow the crafted link, users with lower rights also could access and abuse the database. Solution Update the...

WordPress Easy Modal 2.0.17 Plugin - SQL Injection Vulnerability

Exploit for php platform in category web applications WordPress Easy Modal Plugin Multiple Security Vulnerabilities Advisory Title: WordPress Easy Modal Plugin Multiple Vulnerabilities Advisory URL: http://www.defensecode.com/advisories.php Software: WordPress Easy Modal plugin Language: PHP...

WordPress Plugin Easy Modal 2.0.17 - SQL Injection

DefenseCode ThunderScan SAST Advisory WordPress Easy Modal Plugin Multiple Security Vulnerabilities Advisory ID: DC-2017-01-007 Advisory Title: WordPress Easy Modal Plugin Multiple Vulnerabilities Advisory URL: http://www.defensecode.com/advisories.php Software: WordPress Easy Modal plugin...

chromium-browser: ui spoofing in blink

Inappropriate implementation in modal dialog handling in Blink in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to prevent a full screen warning from being displayed via a crafted HTML page...

Joomla! 3.7 Core SQL Injection (CVE-2017-8917)

Author: p0wd3r know Chong Yu 404 security lab Date: 2017-05-18 0x00 vulnerability overview Vulnerability description Joomla to 5 on 17 May released the new version 3. 7. 1, and https://www.joomla.org/announcements/release-news/5705-joomla-3-7-1-release.html this update fixes a high risk SQL...

WordPress: Self-XSS in WordPress Editor Link Modal

A self-xss was found in the link modal of the WordPress editor and fixed in the WordPress 4.8.2 release. Was a self-xss on the link modal and the WordPress team were very helpful and they made a patch for the bug happy to work with them :...

Mozilla Firefox Denial of Service Vulnerability (CNVD-2017-04191)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the U.S. Thunderbird is a mail tool adapted from the mail widget of the Mozilla browser. A denial of service vulnerability exists in Mozilla Firefox, which can be exploited by an attacker to repeatedly trigger a...

UBUNTU-CVE-2017-5419

If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutdown through the operating system. This is a denial of service DOS attack. This vulnerability affects Firefox 52 and Thunderbird 52...

CVE-2017-5419

If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutdown through the operating system. This is a denial of service DOS attack. This vulnerability affects Firefox 52 and Thunderbird 52...

WordPress Plugin Answer My Question SQL Injection Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the id parameter of the modal.php page of the Wordpress plugin Answer My Question...

Apache Wicket Cross-Site Scripting Vulnerability (CNVD-2016-02205)

Apache Wicket is the United States Apache Apache Software Foundation , a set of open source , lightweight , component-based framework , which provides an object-oriented way to develop Web-based dynamic UI applications . A cross-site scripting vulnerability exists in Apache Wicket's...

Google Chrome suffers from an unspecified vulnerability (CNVD-2015-07969)

Google Chrome is a web browser developed by the American company Google Google. A security vulnerability exists in the 'Document::open' function in the WebKit/Source/core/dom/Document.cpp file in versions of Google Chrome prior to 47.0.2526.73, which stems from the program's failure to ensure tha...