DEBIAN-CVE-2016-1955

Mozilla Firefox before 45.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy CSP violation report that contains path information associated with an IFRAME element...

Mozilla Firefox Sensitive Information Disclosure Vulnerability (CNVD-2016-01683)

Firefox is an open source web browser. Mozilla Firefox suffers from a sensitive information disclosure vulnerability due to Content Security Policy CSP reports containing full path information, which allows remote attackers to exploit the vulnerability to build malicious WEB pages that can be...

FreeBSD : mozilla -- multiple vulnerabilities (2225c5b4-1e5a-44fc-9920-b3201c384a15)

Mozilla Foundation reports : MFSA 2016-16 Miscellaneous memory safety hazards rv:45.0 / rv:38.7 MFSA 2016-17 Local file overwriting and potential privilege escalation through CSP reports MFSA 2016-18 CSP reports fail to strip location information for embedded iframe pages MFSA 2016-19 Linux video...

chromium-browser: CSP implementation in Blink does not ignore a URL's path component in the case of a ServiceWorker fetch

The Content Security Policy CSP implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of a ServiceWorker fetch, which allows remote attackers to obtain sensitive information about visited web pages by reading CSP violation report...

Apache Jetspeed 目录穿越漏洞

通过管理员账号在后台 Portal Site Manger 处 import 恶意构造的 ZIP 文件,ZIP 压缩文件中包含名称为 ../../webapps/de.jsp 的文件,在后台处理 上传时会拼接此文件名导致目录穿越,控制文件上传路径。 poc.zip 包 含 名 为 ../../webapps/ROOT/de.jsp 的 文 件 , 内 容 为 is vulnerable: 上传后,即可在网站根目录根据目标环境决定访问到 de.jsp 文件: 要利用目录穿越上传任意文件虽然需要管理权限的账户,但是通过前一个漏 洞可以轻松创建一个拥有管理者权限的任意账户,再利用此漏洞上传...

CVE-2016-2845

The Content Security Policy CSP implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of a ServiceWorker fetch, which allows remote attackers to obtain sensitive information about visited web pages by reading CSP violation report...

Path traversal

The Content Security Policy CSP implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of a ServiceWorker fetch, which allows remote attackers to obtain sensitive information about visited web pages by reading CSP violation report...

CVE-2016-2845

Removed by vendor...

UBUNTU-CVE-2016-2845

The Content Security Policy CSP implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of a ServiceWorker fetch, which allows remote attackers to obtain sensitive information about visited web pages by reading CSP violation report...

WordPress CP Polls 1.0.8 Cross Site Request Forgery / Cross Site Scripting

Exploit Title: WordPress CP Polls 1.0.8 - CSRF - Update poll settings & Persistent XSS Date: 2016-02-22 Google Dork: Index of /wp-content/plugins/cp-polls/ Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Plugin URI: http://wordpress.dwbooster.com/forms/cp-polls Version: 1.0.8...

WordPress CP Polls 1.0.8 Plugin - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: WordPress CP Polls 1.0.8 - CSRF - Update poll settings & Persistent XSS Date: 2016-02-22 Google Dork: Index of /wp-content/plugins/cp-polls/ Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Plugin URI:...

HackerOne: User with Read-Only permissions can edit the Internal comment Activities on Bug Reports After Revoke the team access permissions

Poc : 1.Login into Programtestbug as Alice account 2.Create a new group with "Read-only" Permission . Add a Bob to that group 3.Bob report a bug to Programtestbug After Post "Some Internal comments" 4.Now Alice Revoke the Bob team access permissions so Bob is no longer part of the team 5.Bob...

HackerOne: User with Read-Only permissions can edit the SwagAwarded Activities on Bug Reports

Poc : 1.Login into Programtestbug as owner account 2.Create a new group with "Reward" Permission . Add a user to that group 3.Create a new group with "Read-only" Permission . Add a user to that group 3.Login into user account Report a bug to Program testbug 4."Reward" Permission User awarded a sw...

ManageEngine Firewall Analyzer 8.5 - Multiple Vulnerabilities

Exploit for windows platform in category web applications ================================================================ ManageEngine Firewall Analyzer 8.5– Privilege Escalation Vulnerability ================================================================ Description : Vulnerability Type :...

ManageEngine Firewall Analyzer 8.5 - Multiple Vulnerabilities

ManageEngine Firewall Analyzer 8.5 - Multiple Vulnerabilities ================================================================ ManageEngine Firewall Analyzer 8.5– Privilege Escalation Vulnerability ================================================================ Description : Vulnerability Type :...

HackerOne: Increase number of bugs by sending duplicate of your own valid report

HI, This report is a basically a design issue and something similar to report where someone can gain reputations by sending dup. Not very high severity bug and i know you all can always roll back the changes. also it lies more on team rather than a system. but it happened before with me although...

Internet Bug Bounty: Type confusion in partial.setstate, partial_repr, partial_call leads to memory corruption, reliable control flow hijack

See my official writeups here: http://bugs.python.org/issue25944 http://bugs.python.org/issue25945 The maintainers merged these bug reports. In one case, the type confusion leads to a reliable control of the instruction pointer as calling repr on a corrupted partial calls a function pointer that ...

CVE-2016-0864

Tollgrade SmartGrid LightHouse Sensor Management System SMS Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to obtain sensitive report and username information via unspecified vectors...

HackerOne: Private Program Disclosure in /:handle/reports/draft.json endpoint

PoC revealed an issue in the HTTP codes returned for the /reports/draft.json endpoint: private team: https://hackerone.com/invite-only team handle/reports/draft.json Returned "error":"You need to sign in or sign up before continuing." with Status Code:401 OK user: https://hackerone.com/user...

Paragon Initiative Enterprises: Cross-domain AJAX request

Hi Paragonie Team, While reviewing your website i discovered that there are Cross-domain AJAX requests being sent, though you are implementing Content-Security-Policy header but Internet Explorer uses experimental X-Content-Security-Policy header according to Wikipedia info...