TIBCO tibbr Multiple Vulnerabilities

TIBCO tibbr is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:tibco:tibbr"; if description...

chromium-browser: uxss with mhtml

Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted MHTML page...

Browser security beyond sandboxing

Security is now a strong differentiator in picking the right browser. We all use browsers for day-to-day activities like staying in touch with loved ones, but also for editing sensitive private and corporate documents, and even managing our financial assets. A single compromise through a web...

CVE-2017-5124

Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted MHTML page...

Cross-domain Flash Injection (XSF)

WordPress is vulnerable to cross-domain flash injection XSF attacks. The attack can be triggered via the code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file. The vulnerability is possible only when domain-based flashmediaelement.swf sandboxing is not used...

DEBIAN-CVE-2016-9263

WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection XSF attacks by leveraging code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file...

CVE-2017-1000107

Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method references, and type coercion expressions. This could be used to invoke arbitrary constructors and methods, bypassing sandbox protection...

CVE-2017-1000107

Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method references, and type coercion expressions. This could be used to invoke arbitrary constructors and methods, bypassing sandbox protection...

CVE-2017-1000107

CVE-2017-1000107 affects the Jenkins Script Security Plugin. The root cause is that sandboxing restrictions were not applied to constructor invocations via positional argument lists, super constructors, method references, or type coercion expressions, allowing potential bypass of sandbox protecti...

KLA11084 Multiple vulnerabilities in Microsoft Edge and Microsoft Internet Explorer

Multiple serious vulnerabilities have been found in Microsoft Internet Explorer and Microsoft Edge. Malicious users can exploit these vulnerabilities to gain privileges, bypass security restrictions, execute arbitrary code and obtain sensitive information. Below is a complete list of...

Tails 3.0 - Live System to Preserve Your Privacy and Anonymity

Tails is a live system that aims to preserve your privacy and anonymity. It helps you to use the Internet anonymously and circumvent censorship almost anywhere you go and on any computer but leaving no trace unless you ask it to explicitly. It is a complete operating system designed to be used fr...

Apple macOS/iOS - Memory Corruption Due to Bad Bounds Checking in NSCharacterSet Coding for NSKeyedUnarchiver

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1168 The dump today has this list of iOS stuff: https://wikileaks.org/ciav7p1/cms/page13205587.html Reading through this sounded interesting: """ Buffer Overflow caused by deserialization parsing error in Foundation library Sending...

Apple macOSiOS - Memory Corruption Due to Bad Bounds Checking in NSCharacterSet Coding for NSKeyedUnarchiver

Apple macOSiOS - Memory Corruption Due to Bad Bounds Checking in NSCharacterSet Coding for NSKeyedUnarchiver Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1168 The dump today has this list of iOS stuff: https://wikileaks.org/ciav7p1/cms/page13205587.html Reading through this...

Firejail Security Bypass Vulnerability

Firejail is a set of SUID programs written in C that reduces the risk of security vulnerabilities by restricting the operating environment of untrusted applications using Linux namespaces and seccomp-bpf, a sandboxing mechanism. A security bypass vulnerability exists in Firejail. An attacker coul...

GLSA-201702-03 : Firejail: Privilege escalation

The remote host is affected by the vulnerability described in GLSA-201702-03 Firejail: Privilege escalation The unaffected packages listed in GLSA 201612-48 had an incomplete fix as reported by Sebastian Krahmer of SuSE. This has been properly patched in the latest releases. Impact : An attacker...

Fedora 24 : tracker (2016-631737a49a)

This update adds security sandboxing to tracker-extract. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

F5 BIG-IP - libarchive vulnerability CVE-2016-5418

The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a...

Tor Project Releases Sandboxed Tor Browser 0.0.2

The non-profit organization behind TOR – the largest online anonymity network that allows people to hide their real identity online – has launched an early alpha version of Sandboxed Tor Browser 0.0.2. Yes, the Tor Project is working on a sandboxed version of the Tor Browser that would isolate th...

openSUSE Security Update : libarchive (openSUSE-2016-1405)

This update for libarchive fixes several issues. These security issues were fixed : - CVE-2016-8687: Buffer overflow when printing a filename bsc1005070. - CVE-2016-8689: Heap overflow when reading corrupted 7Zip files bsc1005072. - CVE-2016-8688: Use after free because of incorrect calculation i...

Mozilla Firefox Denial of Service Vulnerability (CNVD-2016-11414)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A denial-of-service vulnerability exists in versions of Mozilla Firefox prior to 50 on 64-bit Windows-based platforms, which stems from a failure of the 64-bit NPAPI plug-in to enable sandboxin...