4938 matches found
paragonproperty.com.au XSS vulnerability
Vulnerable URL: http://www.paragonproperty.com.au/wp-content/plugins/Realty/display/elements/formcontactagent.php?userid=%22%3C/script%3E%3Cscript%3Ealert%28/OPENBUGBOUNTY/%29%3C/script%3E%27=1 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:|...
Old Android Flaw Elevates Privileges, Steals SMS, Call Logs
A five-year-old Android vulnerability disclosed today affects hundreds of different device models going back to Jelly Bean 4.3. Older devices are at the greatest risk; newer devices running Android with SE Android, the OS’ implementation of Security Enhanced Linux, are at a lesser risk. The...
Platinum APT Group Abuses Windows Hotpatching
An obscure Windows feature known as hotpatching, missing in the OS since the introduction of Windows 8, is a preferred tool used by a resourced attack group called Platinum that was uncovered by Microsoft. The group has carried out targeted attacks in South and Southeast Asia since at least 2009,...
CVE-2015-8823
Use-after-free vulnerability in the TextField object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before...
Design/Logic Flaw
Use-after-free vulnerability in the TextField object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before...
CVE-2015-8823
Use-after-free vulnerability in the TextField object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before...
The vulnerability of the Firefox browser, which allows a hacker to execute arbitrary code
The vulnerability of Firefox browsers is related to errors in the storage of properties of decompressed objects. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely, using specially crafted JavaScript variables...
MagicBricks Property Search - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities
HackApp vulnerability scanner discovered that application MagicBricks Property Search published at the 'play' market has multiple vulnerabilities...
Xalan-Java: Arbitrary code execution
Background Xalan-Java is an XSLT processor for transforming XML documents into HTML, text, or other XML document types. Description The TransformerFactory in Apache Xalan-Java does not properly restrict access to certain properties when FEATURESECUREPROCESSING is enabled. This can also be exploit...
Immonet Property Search - Base64 encoded String, WebView SSL handling enabled, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Immonet Property Search published at the 'play' market has multiple vulnerabilities...
Property Switzerland, Flat - Customized SSL, WebView SSL handling enabled, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Property Switzerland, Flat published at the 'play' market has multiple vulnerabilities...
Arbitrary Code Execution Vulnerability in Multiple Adobe Products (CNVD-2016-01540)
Adobe Acrobat DC, etc. are the United States of America Auduby Adobe company's products. Acrobat DC is a desktop PDF solution; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF.Classic and Continuous are Acrobat DC and Acrobat Reader DC product download center provides...
Arbitrary Code Execution Vulnerability in Multiple Adobe Products (CNVD-2016-01539)
Adobe Acrobat DC, etc. are the United States of America Auduby Adobe company's products. Acrobat DC is a desktop PDF solution; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF.Classic and Continuous are Acrobat DC and Acrobat Reader DC product download center to provid...
Addressbar spoofing though history navigation and Location protocol property — Mozilla
Security researcher Tsubasa Iinuma reported a mechanism where the displayed addressbar can be spoofed to users. This issue involves using history navigation in concert with the Location protocol property. After navigating from a malicious page to another, if the user navigates back to the initial...
Google Chrome Extensions Subsystem Homology Policy Bypass Vulnerability
Google Chrome is a popular web browser. Google Chrome's Extensions subsystem fails to restrict the use of the Object.defineProperty method to rewrite build-in extension code, which can be exploited by remote attackers to bypass the same-origin policy using specially crafted JavaScript code...
chromium-browser: same-origin bypass in Extensions
The Extensions subsystem in Google Chrome before 48.0.2564.109 does not prevent use of the Object.defineProperty method to override intended extension behavior, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code...
CVE-2016-1622
The Extensions subsystem in Google Chrome before 48.0.2564.109 does not prevent use of the Object.defineProperty method to override intended extension behavior, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code...
conifer-property-services.co.uk XSS vulnerability
Vulnerable URL: http://www.conifer-property-services.co.uk/EmailPage.asp?PageTitle=Welcome+to+Conifer+Property+Services+Ltd%27%3E%22%3E%3Cscript%3Ealert%28/xssposed/%29%3C/script%3E=EmailPage.asp==Yes Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerabili...
Updated apache-commons-collections packages fix security vulnerability
It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections...
