2895 matches found
TYPO3 'data:' URL Scheme Cross-Site Scripting Vulnerability
TYPO3 is a free and open source content management system maintained by the Swiss TYPO3 Association. A cross-site scripting vulnerability exists in TYPO3. Because the program fails to properly filter user-supplied input, an attacker may be able to exploit the vulnerability to execute arbitrary...
Russian Lawmaker's Son Convicted of Stealing 2.9 Million Credit Card Numbers
The son of a prominent Russian lawmaker has been found guilty in the United States of running a hacking scheme that stole and sold 2.9 million US credit card numbers using Point-of-Sale POS malware, costing financial institutions more than $169 Million. Roman Seleznev, 32, the son of Russian...
jenkins: Open redirect to scheme-relative URLs (SECURITY-276)
Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors related to "scheme-relative" URLs...
The vulnerability of the Firefox browser, which allows a hacker to replace the address bar
The vulnerability of Firefox browsers exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to substitute the URL field using special characters in the data:URL format...
UBUNTU-CVE-2016-5266
Mozilla Firefox before 48.0 does not properly restrict drag-and-drop aka dataTransfer actions for file: URIs, which allows user-assisted remote attackers to access local files via a crafted web site...
Google Chrome CSPSource::schemeMatches Information Disclosure Vulnerability
Google Chrome is a web browsing tool developed by Google. In the CSP implementation of Blink in versions of Google Chrome prior to 52.0.2743.82, the WebKit/Source/core/frame/csp/CSPSource.cpp/CSPSource::schemeMatches function does not apply the http :80 policy to the https : 443 URL, nor does it...
CVE-2016-5137
The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy CSP implementation in Blink, as used in Google Chrome before 52.0.2743.82, does not apply http :80 policies to https :443 URLs and does not apply ws :80 policies to wss :443 URLs,...
CVE-2016-3763
net/PacProxySelector.java in the Proxy Auto-Config PAC feature in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by...
Android KeyStore Encryption Scheme Broken, Researchers Say
The default implementation for KeyStore, the system in Android designed to store user credentials and cryptographic keys, is broken, researchers say. In a an academic paper published this week, researchers argue that the particular encryption scheme that KeyStore uses fails to protect the integri...
Second 'Fappening' Hacker Pleads Guilty; Facing up to 5 years in Prison
A second man has pleaded guilty for his role in 'The Fappening' breach of 2014, in which the Internet was flooded with thousands of photographs of popular celebrities, including Jennifer Lawrence, Kim Kardashian, Kate Upton and Kirsten Dunst. Edward Majerczyk 28 of Chicago, Illinois agreed to ple...
The vulnerability of the Mozilla SeaMonkey software package allows a malicious individual to inject any web script or HTML code they desire.
Mozilla SeaMonkey software contains a vulnerability related to cross-site scripting XSS. Exploiting this vulnerability allows malicious actors to inject arbitrary web scripts or HTML code through an email containing a data:URL element within an OBJECT or EMBED tag...
When JIRA project has a security scheme, the option "None" is not displayed in Crucible
h3. Summary Whenever a JIRA project has a Security Scheme defined, and a workflow transition has at least one required field, a window is opened in JIRA side so that the required field/s are selected. Among the fields displayed in this window there will be the "Security Level", in which the...
When JIRA project has a security scheme, the option "None" is not displayed in Crucible
h3. Summary Whenever a JIRA project has a Security Scheme defined, and a workflow transition has at least one required field, a window is opened in JIRA side so that the required field/s are selected. Among the fields displayed in this window there will be the "Security Level", in which the...
BadTunnel: Cross-Segment hijacking the broadcast Protocol-vulnerability warning-the black bar safety net
! 0x00 introduction This paper proposes a new attack model, can cross network segment hijacking the TCP/IP broadcast Protocol, we named it“BadTunnel” in. Using this method, you can achieve cross-subnet NetBIOS Name Service Spoofing attacks. Both the attacker and the user are in the same network...
CVE-2016-2825
Mozilla Firefox before 47.0 allows remote attackers to bypass the Same Origin Policy and modify the location.host property via an invalid data: URL...
UBUNTU-CVE-2016-2825
Mozilla Firefox before 47.0 allows remote attackers to bypass the Same Origin Policy and modify the location.host property via an invalid data: URL...
jenkins: Open redirect to scheme-relative URLs (SECURITY-276)
Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors related to "scheme-relative" URLs...
Struts2 remote code execution vulnerability S2-0 3 3 technology analysis and protection solution-vulnerability warning-the black bar safety net
Apache Struts2 in open dynamic method invocation Dynamic Method Invocation case, the attacker using the REST plug-in calls a malicious expression can be remote code execution. This vulnerability number CVE-2 0 1 6-3 0 8 7, named S2-0 3 of 3. This article on the vulnerability of technical analysis...
