USN-2993-1 firefox vulnerabilities

Christian Holler, Gary Kwong, Jesse Ruderman, Tyson Smith, Timothy Nikkel, Sylvestre Ledru, Julian Seward, Olli Pettay, Karl Tomlinson, Christoph Diehl, Julian Hector, Jan de Mooij, Mats Palmgren, and Tooru Fujisawa discovered multiple memory safety issues in Firefox. If a user were tricked in to...

Mozilla: Addressbar spoofing though the SELECT element (MFSA 2016-52)

Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to spoof the address bar via a SELECT element with a persistent menu...

UBUNTU-CVE-2016-2822

Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to spoof the address bar via a SELECT element with a persistent menu...

Addressbar spoofing though the SELECT element — Mozilla

Security researcher Jordi Chancel reported a method to spoof the contents of the addressbar. This uses a persistent menu within a element, which acts as a container for HTML content and can be placed in an arbitrary location. When placed over the addressbar, this can mask the true site URL,...

IBM DB2 LUW Denial of Service Vulnerability (CNVD-2016-02177)

IBM DB2 LUW is a set of U.S. IBM's relational database management system running in the LUW Linux, UNIX and Windows platform. A security vulnerability exists in IBM DB2 LUW. A remote attacker can exploit this vulnerability to cause a denial of service service interruption with the help of a...

akcms 4.0.9 akcms_keyword.php SQL注入漏洞

AKCMS是国内最著名的轻量级CMS建站程序，在主流PHP建站系统中特色鲜明，以灵活、小巧、兼容性好、负载强等优点而深受许多站长的喜爱。 但在 akcms 4.0.9 中，akcmskeyword.php 此文件中存在sql注入漏洞 akcmskeyword.php： systemroot 是和后台目录对应的 可以看到包含了/fore/keyword.php。 我们继续跟进一下这个文件：admin/fore/keyword.php getby'', 'keywords', "sid='$sid' AND keyword='".addslashes$keyword."'";...

正方教务系统 ResultXml_common.aspx SQL 注入漏洞

Payload: /ResultXmlcommon.aspx?k=%&column='username='||xh||''||'passwd='||mm||''&table=xsjbxxb+where+rownum"; xml = xml + "" + dr0.ToString + ""; dr.Close; comm.Dispose; conn.Close; xml = x...

CVE-2015-7857: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the getListQuery function in administrator/components/comcontenthistory/models/history.php in Joomla! 3.2 before 3.4.5 allows remote attackers to execute arbitrary SQL commands via the listselect parameter to index.php...

PT-2015-7647

Name of the Vulnerable Software and Affected Versions Joomla! versions prior to 3.4.5 Description A SQL injection issue exists in the getListQuery function in administrator/components/com contenthistory/models/history.php, allowing remote attackers to execute arbitrary SQL commands via the...

SUSE: Security Advisory for kernel (SUSE-SU-2015:0529-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2015-7576

Name of the Vulnerable Software and Affected Versions Pie Register plugin versions prior to 2.0.19 Description The issue allows remote administrators to execute arbitrary SQL commands. This can be achieved via the select invitaion code bulk option or invi del id parameter in the...

openSUSE Security Update : MozillaFirefox (openSUSE-2015-565)

MozillaFirefox was updated to version 40.0.3 to fix two security issues and several bugs. Changes in MozillaFirefox : - update to Firefox 40.0.3 bnc943550 - Disable the asynchronous plugin initialization bmo1198590 - Fix a segmentation fault in the GStreamer support bmo1145230 - Fix a regression...

[SECURITY] Fedora 21 Update: drupal6-views_bulk_operations-1.17-1.fc21

This module augments Views by allowing bulk operations to be executed on the displayed rows. It does so by showing a checkbox in front of each node, and adding a select box containing operations that can be applied. Drupal Core or Rules actions can be used. This package provides the following...

Android Dolphin Browser remote code execution-vulnerability warning-the black bar safety net

The attacker has the ability to by Android the Dolphin Browser to control the user's network communication data, you can modify the download and application browser new theme function. By using this function, an attacker can write arbitrary files, these files will be in the user device browser...

Scientific Linux Security Update : sqlite on SL7.x x86_64 (20150817)

A flaw was found in the way SQLite handled dequoting of collation-sequence names. A local attacker could submit a specially crafted COLLATE statement that would crash the SQLite process, or have other unspecified impacts. CVE-2015-3414 It was found that SQLite's sqlite3VdbeExec function did not...

lemon, sqlite security update

CentOS Errata and Security Advisory CESA-2015:1634 An updated sqlite package that fixes one security issue is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, whi...

CVE-2014-8910

IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read arbitrary text files via a crafted XML/XSLT function in a SELECT statement...

[SECURITY] Fedora 22 Update: drupal7-views_bulk_operations-3.3-1.fc22

This module augments Views by allowing bulk operations to be executed on the displayed rows. It does so by showing a checkbox in front of each node, and adding a select box containing operations that can be applied. Drupal Core or Rules actions can be used. This package provides the following...

IBM DB2 XML/XSLT Function File Read Vulnerability

IBM DB2 is a set of relational database management system developed by IBM in the United States, and its main operating environments are UNIX including IBM's own AIX, Linux, IBM i formerly known as OS/400, z/OS, and Windows server versions. IBM DB2 has a security vulnerability that allows...

PHP云人才系统最新版1处SQL注入(union select)

简要描述： PHP云人才系统最新版1处SQL注入union select，无需登陆，可取任意数据。 官网demo测试。 详细说明： 最新版全局过滤函数修改：config/db.safety.php 27 function gpc2sql$str,$str2 28 29 ifpregmatch"/select|insert|update|delete|union|loadfile|outfile/is", $str 30 31 exitsafepape; 32 33 34...