59 matches found
Third party CSS is not safe
A few days ago there was a lot of chatter about a 'keylogger' built in CSS. Some folks called for browsers to 'fix' it. Some folks dug a bit deeper and saw that it only affected sites built in React-like frameworks, and pointed the finger at React. But the real problem is thinking that third part...
Apple iOS WebKit Information Disclosure Vulnerability (CNVD-2016-03339)
Apple iOS is the United States Apple Apple company for mobile devices developed by a set of operating systems. WebKit is KDE, Apple Apple, Google Google and other companies jointly developed a set of open source Web browser engine, currently used by Apple Safari and Google Chrome and other...
jenkins: Jenkins plugin manager vulnerable to MITM attacks (SECURITY-234)
The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted plugin...
CVE-2015-7539
The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted plugin...
jenkins: Jenkins plugin manager vulnerable to MITM attacks (SECURITY-234)
The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted plugin...
Apple iOS Webkit 'canvas' element image processing information disclosure vulnerability
Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A security vulnerability in Apple iOS Webkit's handling of 'canvas' element images allows attackers to construct malicious WEB pages that can be parsed by tricking users into parsing them, which can acces...
WordPress Backup Plugin 2.0.1 Information Disclosure
No description provided by source. Exploit Title: WordPress Backup plugin exposes site data Google Dork: http://www.google.com/search?q=inurl:wp-content/backup.log Date: 01-jul-2012 Exploit Author: Stephan Knauss Vendor Homepage: http://wordpress.org/extend/plugins/backup/ Software Link:...
Flash content-type sniffing allows Cross Site Data Hijacking
As documented at http://blog.detectify.com/post/86298380233/the-pitfalls-of-allowing-file-uploads-on-your-website it is possible to upload a flash file to confluence with a different content-type than for flash and when embedded on an attacker's domain will be able to make requests to the...
Flash content-type sniffing allows Cross Site Data Hijacking
As documented at http://blog.detectify.com/post/86298380233/the-pitfalls-of-allowing-file-uploads-on-your-website it is possible to upload a flash file to confluence with a different content-type than for flash and when embedded on an attacker's domain will be able to make requests to the...
The music he multi-language shop system The exploitability of the vulnerability.-vulnerability warning-the black bar safety net
In fact, is counted as the Administrator's mistake, if in accordance with the management operations manual, there is absolutely no problem Dork: A Powered By 5 6 7 7 0 Eshop Then check the web root directory is there install as you 9 0% can take down the website. exp: site+install/Install. asp?...
Google Chrome Cross Site Data Leakage Vulnerability (Windows)
This host is installed with Google Chrome Web Browser and is prone to cross site data leakage vulnerability. OpenVAS Vulnerability Test $Id: gbgooglechromecrosssitedataleakagevuln.nasl 5306 2017-02-16 09:00:16Z teissa $ Google Chrome Cross Site Data Leakage Vulnerability Windows Authors: Antu...
Microsoft Internet Explorer Cross Site Data Leakage Vulnerability
This host is installed with Microsoft Internet Explorer web browser and is prone to cross site data leakage vulnerability. OpenVAS Vulnerability Test $Id: gbmsiecrosssitedataleakagevuln.nasl 5323 2017-02-17 08:49:23Z teissa $ Microsoft Internet Explorer Cross Site Data Leakage Vulnerability...
Google Chrome Cross Site Data Leakage Vulnerability - Windows
Google Chrome Web Browser is prone to cross site data leakage vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2010-1851
Google Chrome, when the Invisible Hand extension is enabled, uses cookies during background HTTP requests in a possibly unexpected manner, which might allow remote web servers to identify specific persons and their product searches via HTTP request logging, related to a "cross-site data leakage"...
Cross site scripting
Google Chrome, when the Invisible Hand extension is enabled, uses cookies during background HTTP requests in a possibly unexpected manner, which might allow remote web servers to identify specific persons and their product searches via HTTP request logging, related to a "cross-site data leakage"...
CVE-2010-1851
Google Chrome, when the Invisible Hand extension is enabled, uses cookies during background HTTP requests in a possibly unexpected manner, which might allow remote web servers to identify specific persons and their product searches via HTTP request logging, related to a "cross-site data leakage"...
EUVD-2010-1872
Microsoft Internet Explorer, when the Invisible Hand extension is enabled, uses cookies during background HTTP requests in a possibly unexpected manner, which might allow remote web servers to identify specific persons and their product searches via HTTP request logging, related to a "cross-site...
CVE-2010-1852
Microsoft Internet Explorer, when the Invisible Hand extension is enabled, uses cookies during background HTTP requests in a possibly unexpected manner, which might allow remote web servers to identify specific persons and their product searches via HTTP request logging, related to a "cross-site...
DEBIAN-CVE-2008-1318
Unspecified vulnerability in MediaWiki 1.11 before 1.11.2 allows remote attackers to obtain sensitive "cross-site" information via the callback parameter in an API call for JavaScript Object Notation JSON formatted results...