2843 matches found
AUFS (Ubuntu 15.10) - 'allow_userns' Fuse/Xattr User Namespaces Privilege Escalation
Source: http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces/ Introduction Problem description: Aufs is a union filesystem to mix content of different underlying filesystems, e.g. read-only medium with r/w RAM-fs. That is also allowed in user namespaces when module was...
Control CSS loading with custom properties
Last week I wrote about a simple method to load CSS progressively, and on the very same day some scientists taught gravity how to wave. Coincidence? Yes. The pattern in the previous post covers the 90% case of multi-stage CSS loading, and it's really simple to understand. But would you like to he...
tour.gallesproperties.com XSS vulnerability
Vulnerable URL: http://tour.gallesproperties.com/error.htm?message=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...
indiaproperty.com XSS vulnerability
Vulnerable URL: http://www.indiaproperty.com/searchs/l=kamothe=allresidential=mumbai=sale=mNe00^^FYnd3dcaehZqOpi9WblbGrZqyhWeLjoqRqZKarWt3OlNXq2dGio93cmbKZWdncxtaXn9jYpOfSlta0lZieoea2ZJvVnOW02NOelprpndmmZA===1=16=facet-search"=srch=1=all=0"=grid Details: Description| Value ---|--- Patched:| Yes, ...
ir.franklinstreetproperties.com Open Redirect vulnerability
Vulnerable URL: http://ir.franklinstreetproperties.com/PDFPageView.aspx?iid=4065591=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at 16.03.2016 Latest check for patch:| 16.03.2016 04:32 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed...
Mozilla Firefox Arbitrary Code Execution Vulnerability (CNVD-2015-08314)
Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox 42.0 and earlier versions, which is caused by the program failing to properly store properties of an unwrapped object. The vulnerability can b...
DEBIAN-CVE-2015-8369
SQL injection vulnerability in include/topgraphheader.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL commands via the rraid parameter in a properties action to graph.php...
cacti -- SQL injection vulnerabilities
NVD reports: SQL injection vulnerability in include/topgraphheader.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL commands via the rraid parameter in a properties action to graph.php...
Tibbo AggreGate SCADA/HMI Server Service uploadDirectory Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tibbo AggreGate SCADA/HMI. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Windows service "AggreGate Server Service" agserverservice.exe. Through...
[SECURITY] Fedora 22 Update: openstack-ironic-discoverd-1.1.1-1.fc22
ironic-discoverd is a service for discovering hardware properties for a node managed by OpenStack Ironic. Hardware introspection or hardware properties discovery is a process of getting hardware parameters required for scheduli ng from a bare metal node, given it's power management credentials e....
[SECURITY] Fedora 23 Update: openstack-ironic-discoverd-1.1.1-1.fc23
ironic-discoverd is a service for discovering hardware properties for a node managed by OpenStack Ironic. Hardware introspection or hardware properties discovery is a process of getting hardware parameters required for scheduli ng from a bare metal node, given it's power management credentials e....
Unspecified Vulnerability in Oracle Sun Solaris (CNVD-2015-06814)
Oracle Sun Solaris is a set of Unix-like operating systems from Oracle. An unspecified vulnerability exists in Oracle Sun Solaris 11.2. The vulnerability allows local users to affect confidentiality, integrity, and availability via unspecified vectors related to utilities/security...
Ignite Realtime Openfire server-props.jsp Cross-Site Request Forgery (CVE-2015-6973)
A cross-site request forgery vulnerability has been reported in Openfire's server-props.jsp script. The vulnerability is due to insufficient CSRF protections. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user with administrative privileges to visit a page which...
Ubuntu 14.04 LTS : Firefox regression (USN-2743-4)
The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2743-4 advisory. USN-2743-1 fixed vulnerabilities in Firefox. After upgrading, some users reported problems with bookmark creation and crashes in some circumstances. This update...
Cross site scripting
Cross-site scripting XSS vulnerability in unspecified dialogs for printing content in the Front End in Open-Xchange Server 6 and OX App Suite before 6.22.8-rev8, 6.22.9 before 6.22.9-rev15m, 7.x before 7.6.1-rev25, and 7.6.2 before 7.6.2-rev20 allows remote attackers to inject arbitrary web scrip...
Ubuntu 14.04 LTS : Unity Integration for Firefox, Unity Websites Integration and Ubuntu Online Accounts extension update (USN-2743-3)
The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2743-3 advisory. USN-2743-1 fixed vulnerabilities in Firefox. Future Firefox updates will require all addons be signed and unity-firefox-extension, webapps-greasemonkey and...
USN-2743-1: Firefox vulnerabilities
Andrew Osmond, Olli Pettay, Andrew Sutherland, Christian Holler, David Major, Andrew McCreight, Cameron McCormack, Bob Clary and Randell Jesup discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially explo...
JavaScript immutable property enforcement can be bypassed — Mozilla
Mozilla developer Jeff Walden reported that in Gecko's implementation of ECMAScript 5 API's enforces non-configurable properties with logic specific to each API. Scripts that do not go through these APIs can bypass these protections and make changes to the immutable properties in violation of...
UBUNTU-CVE-2015-4516
Mozilla Firefox before 41.0 allows remote attackers to bypass certain ECMAScript 5 aka ES5 API protection mechanisms and modify immutable properties, and consequently execute arbitrary JavaScript code with chrome privileges, via a crafted web page that does not use ES5 APIs...
