CVE-2015-5256

Summary of CVE-2015-5256 : Apache Cordova-Android before 4.1.0 contains a flaw in the remote server relyance whitelisting mechanism that allows an attacker to bypass intended access restrictions by crafting a URI. This can enable execution of non-whitelisted JavaScript. Concrete details from conn...

CVE-2015-7777

Cross-site scripting XSS vulnerability in index.php in JosephErnest Void before 2015-10-02 allows remote attackers to inject arbitrary web script or HTML via a crafted URI...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in JosephErnest Void before 2015-10-02 allows remote attackers to inject arbitrary web script or HTML via a crafted URI...

CVE-2015-7777

Cross-site scripting XSS vulnerability in index.php in JosephErnest Void before 2015-10-02 allows remote attackers to inject arbitrary web script or HTML via a crafted URI...

Shopify: CSV Excel Macro Injection Vulnerability in export list of current users - app.shopify.com

Hi , I have found that when a user tries to Export list of current users who installed his apps through: https://app.shopify.com/services/partners/apiclients//exportinstalledusers the fields of the CSV file are not properly escaped. which makes them vulnerable to CSV Excel Macro Injection...

SolarWinds DameWare Mini Remote Control < 12.0 Hotfix 1 DWRCC.exe RCE

The remote host is running a version of SolarWinds DameWare Mini Remote Control prior to 12.0 Hotfix 1. It is, therefore, affected by a remote code execution vulnerability due to a flaw in the DWRCC.exe URI handler that is triggered when handling certain command line arguments. An unauthenticated...

CVE-2015-8220

Stack-based buffer overflow in the URI handler in DWRCC.exe in SolarWinds DameWare Mini Remote Control before 12.0 HotFix 1 allows remote attackers to execute arbitrary code via a crafted commandline argument in a link...

Stack overflow

Stack-based buffer overflow in the URI handler in DWRCC.exe in SolarWinds DameWare Mini Remote Control before 12.0 HotFix 1 allows remote attackers to execute arbitrary code via a crafted commandline argument in a link...

Android Browser应用程序拒绝服务漏洞

Android 4.0.3浏览器应用不正确处理特殊的URI，允许攻击者在IFRAME元素SRC属性中使用特制的market: URI并诱使应用程序解析，可使应用程序崩溃。 测试方法 var mframe = ""; forvar i = 0; i...

Multiple Huawei Product Catalog Traversal Vulnerabilities

The Huawei HG532e, HG532n and HG532s are wireless router products from Huawei China. A directory traversal vulnerability exists in multiple Huawei products. A remote attacker can leverage the directory traversal character '...' in the icon/ URI to read arbitrary files. This vulnerability can be...

Mail.ru: [maps.me] Reflected XSS

Browser-specific reflected XSS via URI parameters in maps.me project. maps.me is not currently in bug bounty scope...

Directory traversal

Directory traversal vulnerability on Huawei HG532e, HG532n, and HG532s devices allows remote attackers to read arbitrary files via a .. dot dot in an icon/ URI...

CVE-2015-7254

Huawei HG532e, HG532n and HG532s home gateways are affected by a directory traversal vulnerability (CVE-2015-7254) that allows remote attackers to read arbitrary files via a crafted request to /icon/. The root cause is improper validation of HTTP requests on a specific port, enabling access to lo...

Mail.ru: [id.my.com] Reflected XSS

Browser-specific reflected XSS via URI parameters in id.my.com. id.my.com is not covered by bug bounty scope...

Reading sensitive profile files through local HTML file on Android — Mozilla

Security researcher Jordi Chancel reported an issue in Firefox for Android where a locally saved HTML file could use file: URIs to trigger the download of additional files or opening of cached profile data without user awareness...

Mail.ru: [lucky-fields.my.com] Reflected XSS

Browser-specific reflected XSS via URI parameters in lucky-fields.my.com. lucky-fields.my.com is not covered by bug bounty scope...

Mail.ru: [mg.my.com] Reflected XSS

Browser-specific reflected XSS via URI parameters in mg.my.com. mg.my.com is not covered by bug bounty scope...

Mail.ru: [games.my.com] Reflected XSS

Browser-specific reflected XSS via URI parameters in games.my.com. games.my.com is not covered by bug bounty scope...

Mail.ru: [aw.my.com] Reflected XSS

Browser-specific reflected XSS via URI parameters in aw.my.com. aw.my.com is not covered by bug bounty scope...

CVE-2007-4038

Argument injection vulnerability in Mozilla Firefox before 2.0.0.5, when running on systems with Thunderbird 1.5 installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto URI, which...