Design/Logic Flaw

The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url parameter to 1 api/openUrlInDefaultBrowser or 2 api/showSB...

CVE-2016-3987

The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url parameter to 1 api/openUrlInDefaultBrowser or 2 api/showSB...

CVE-2016-1772

The Top Sites feature in Apple Safari before 9.1 mishandles cookie storage, which makes it easier for remote web servers to track users via unspecified vectors...

Design/Logic Flaw

The Top Sites feature in Apple Safari before 9.1 mishandles cookie storage, which makes it easier for remote web servers to track users via unspecified vectors...

CVE-2016-1781

CVE-2016-1781 affects Apple WebKit in iOS before 9.3 and Safari before 9.1, where handling of attachment URLs could enable remote tracking of users via unspecified vectors. The Apple security content for Safari 9.1 (WebKit entry) indicates a concrete mitigation: a hidden web page may access devic...

CVE-2016-1772

The Top Sites feature in Apple Safari before 9.1 mishandles cookie storage, which makes it easier for remote web servers to track users via unspecified vectors...

Trust Management Vulnerability in Multiple Arris Devices

The Arris DG860A, TG862A and TG862G are modem products from the Arris Group of Companies. A security vulnerability exists in a number of Arris devices that stems from a program using hard-coded passwords based on serial numbers. The vulnerability can be exploited by a remote attacker to gain acce...

Centreon 2.6.x < 2.6.5 Multiple Vulnerabilities

According to its version number, the Centreon application hosted on the remote web server is version 2.6.x prior to 2.6.5. It is, therefore, affected by multiple vulnerabilities : - A cross-site request forgery XSRF vulnerability exists in the main.php script. A remote attacker can exploit this t...

Apple iOS CFNetwork cookie rewriting vulnerability

iOS is an operating system developed by Apple for mobile devices. A rewrite vulnerability exists in the Apple iOS CFNetwork cookie. An attacker can exploit this vulnerability to rewrite cookie values via a remote web server...

Code injection

CFNetwork in Apple iOS before 9.1 and OS X before 10.11.1 does not properly consider the uppercase-versus-lowercase distinction during cookie parsing, which allows remote web servers to overwrite cookies via unspecified vectors...

Cross site scripting

The CSSFontFaceSrcValue::fetch function in core/css/CSSFontFaceSrcValue.cpp in the Cascading Style Sheets CSS implementation in Blink, as used in Google Chrome before 46.0.2490.71, does not use the CORS cross-origin request algorithm when a font's URL appears to be a same-origin URL, which allows...

Apple iOS Warns of Message Denial of Service Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A security vulnerability exists in Apple iOS that allows a remote WEB server to generate a large number of alert messages, resulting in a denial-of-service attack...

WordPress Multiple XSS

According to its version number, the WordPress application running on the remote web server is either version 3.7.x prior to 3.7.8, 3.8.x prior to 3.8.8, 3.9.x prior to 3.9.6, 4.1.x prior to 4.1.5, or 4.2.x prior to 4.2.2. It is, therefore, potentially affected by multiple cross-site scripting...

X2Engine < 4.0 ProfileController.php Unrestricted File Upload Vulnerability

According to its version number, the X2Engine application installed on the remote web server is prior to version 4.0. It is, therefore, potentially affected by a file upload vulnerability in the '/protected/controllers/ProfileController.php' script. An attacker can exploit this issue to upload...

SerVision HVG Security Bypass Vulnerability

SerVision HVG Video Gateway is an intelligent video gateway product from SerVision Israel. A security vulnerability exists in SerVision HVG Video Gateway versions prior to 2.2.26a78, which stems from the program's use of a hard-coded administrator password. A remote attacker can exploit this...

MyBB < 1.6.13 Multiple Vulnerabilities

Binary data 8629.prm...

Out-of-bounds

The curleasyduphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPTCOPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information...

CVE-2014-3707

The curleasyduphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPTCOPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information...

PHP 5.5.x < 5.5.19 'donote' DoS

According to its banner, the version of PHP 5.5.x installed on the remote host is prior to 5.5.19. It is, therefore, affected by an out-of-bounds read error in the function 'donote' within the file 'ext/fileinfo/libmagic/readelf.c' that could allow application crashes. Note that Nessus has not...

CVE-2014-8351

SQL injection vulnerability in info.php in French National Commission on Informatics and Liberty aka CNIL CookieViz before 1.0.1 allows remote web servers to execute arbitrary SQL commands via the domain parameter...