PU Pocket Campus App has information leakage vulnerability

PU Pocket Campus APP is developed by Suzhou Tiangong Information Technology Co., Ltd. a real-name interactive Internet platform for college students. PU Pocket Campus APP has an information leakage vulnerability, which can be exploited by attackers to obtain sensitive information...

PU Pocket Campus App Exploits Arbitrary Password Reset Vulnerability

PU Pocket Campus APP, developed by Suzhou Tiangong Information Technology Co., Ltd, is a real-name interactive Internet platform for college students, where students can participate in online activities to obtain "second class" credits and employment training support. There is an arbitrary passwo...

Cross Origin Resource Sharing (CORS)

Firefox ESR and Firefox are vulnerable to cross origin resource sharingCORS bypass. A validation flaw in the Pocket toolbar allows a remote attacker to inject content and commands into the Pocket context enabling access to restricted resources...

Cross-site Scripting (XSS)

Firefox ESR and Firefox are vulnerable to cross-site scripting XSS attacks. A remote attacker can exploit an input validation flaw in the Pocket server to execute arbitrary JavaScript in the about:pocket-saved page and access the Pocket messaging API...

Tianyi Life Jiangsu Telecom Palm Business Hall APP has multiple vulnerabilities

Tianyi Life Jiangsu Telecom Pocket Business Hall APP is a handheld service mobile software launched by Jiangsu Telecom. There are multiple vulnerabilities in Tianyi Life Jiangsu Telecom Handheld Business Office APP, which can be exploited by attackers to obtain sensitive user information...

Nanjing Mapu Technology Co. Pocket University 1+4 Universal Program has a flawed logic vulnerability

Nanjing Mapu Technology Co. Pocket University 1+4 Universal Program is comprehensive mobile application service app. A logic flaw vulnerability exists in the Pocket University 1+4 Universal Program of Nanjing Mapu Technology Co. An attacker can exploit the vulnerability to obtain sensitive...

xss vulnerability in palm bookstore app

Palm Book City is the official APP of Shenzhen Book City under Shenzhen Publishing and Distribution Group. There is an xss vulnerability in Pocket Book City APP, which can be exploited by an attacker to obtain an administrator cookie...

pocket-girl.gamerch.com XSS vulnerability

Open Bug Bounty ID: OBB-647569 Description| Value ---|--- Affected Website:| pocket-girl.gamerch.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2016-9902

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10...

DEBIAN-CVE-2016-9901

HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" unprivileged page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR 45.6 and Firefox...

CVE-2016-9902

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10...

DEBIAN-CVE-2016-9902

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10...

Design/Logic Flaw

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10...

CVE-2016-9902

The CVE-2016-9902 entry concerns Mozilla Firefox/Firefox ESR where the Pocket toolbar button incorrectly accepts events from any origin without verifying the event source. The vulnerability arises from the button listening for events fired from its own pages but not validating the origin, enablin...

CVE-2016-9901

HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" unprivileged page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR 45.6 and Firefox...

CVE-2016-9902

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10...

CVE-2016-9902

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10...

CVE-2016-9902

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10...

CVE-2016-9901

HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" unprivileged page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR 45.6 and Firefox...

CVE-2016-9901

HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" unprivileged page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR 45.6 and Firefox...