Design/Logic Flaw

The AppWidgetServiceImpl implementation in com/android/server/appwidget/AppWidgetServiceImpl.java in the Settings application in Android before 5.1.1 LMY48I allows attackers to obtain a URI permission via an application that sends an Intent with a 1 FLAGGRANTREADURIPERMISSION or 2...

CVE-2015-1541

The AppWidgetServiceImpl implementation in com/android/server/appwidget/AppWidgetServiceImpl.java in the Settings application in Android before 5.1.1 LMY48I allows attackers to obtain a URI permission via an application that sends an Intent with a 1 FLAGGRANTREADURIPERMISSION or 2...

CVE-2015-1541

CVE-2015-1541 affects Android before version 5.1.1 (LMY48I). The issue resides in AppWidgetServiceImpl in Settings, where an application can obtain a URI permission by sending an Intent with FLAG_GRANT_READ_URI_PERMISSION or FLAG_GRANT_WRITE_URI_PERMISSION. This bypasses intended restrictions and...

CVE-2015-1541

The AppWidgetServiceImpl implementation in com/android/server/appwidget/AppWidgetServiceImpl.java in the Settings application in Android before 5.1.1 LMY48I allows attackers to obtain a URI permission via an application that sends an Intent with a 1 FLAGGRANTREADURIPERMISSION or 2...

Apple Safari URI spoofing (CVE-2015-5764)

tl;dr Apple Safari for OS X was prone to URI spoofing vulnerability and more general a user interface spoofing. Apple released security updates for Safari 9 on OS X and assigned CVE-2015-5764. Accidentally this vulnerability was also present in iOS. Instant demo In Safari up to 8.0.8 : go to clic...

IBM OpenPages GRC Platform Cross-Site Request Forgery Vulnerability

IBM OpenPages GRC Platform is a suite of governance, risk and compliance platforms for managing enterprise risk and compliance challenges. A cross-site request forgery vulnerability exists in IBM OpenPages GRC Platform that allows a remote attacker to construct a malicious URI, trick a user into...

Mozilla Firefox and Firefox ESR HTMLVideoElement Interface Memory Error Vulnerability

Mozilla Firefox is an open source web browser. A memory error vulnerability exists in the Mozilla Firefox HTMLVideoElement interface, which allows remote attackers to modify the JavaScript code of the media element URI form to crash the application or execute arbitrary code...

Cisco TelePresence Server Software Cross-Site Request Forgery Vulnerability

Cisco TelePresence Server Software is a videoconferencing solution known as a "telepresence" system. A cross-site request forgery vulnerability exists in Cisco TelePresence Server Software that could allow a remote attacker to construct a malicious URI, trick a user into resolving it, and perform...

Design/Logic Flaw

Use-after-free vulnerability in the HTMLVideoElement interface in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via crafted JavaScript code that modifies the URI table of a media element, aka ZDI-CAN-3176...

CVE-2015-4509

Mozilla Firefox: CVE-2015-4509 is a use-after-free in the HTMLVideoElement interface that could let remote attackers execute arbitrary code via crafted JavaScript manipulating a media element URI table (aka ZDI-CAN-3176). Affected versions are Firefox before 41.0 and Firefox ESR 38.x before 38.3....

CVE-2015-4509

Use-after-free vulnerability in the HTMLVideoElement interface in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via crafted JavaScript code that modifies the URI table of a media element, aka ZDI-CAN-3176...

CVE-2015-4509

Use-after-free vulnerability in the HTMLVideoElement interface in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via crafted JavaScript code that modifies the URI table of a media element, aka ZDI-CAN-3176...

Drupal OSF Module Cross-Site Request Forgery Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site request forgery vulnerability exists in the Drupal OSF module when the OSF Ontology and OSF Import modules are enabled in the program, which allows remote attackers to construct malicious URIs, trick users...

Securifi Almond Cross-Site Request Forgery Vulnerability

Securifi Almond is a wireless router product from Securifi. Securifi Almond uses a default password and suffers from a cross-site request forgery vulnerability that allows remote attackers to construct malicious URIs, trick users into parsing them, and can perform malicious actions in the context...

Orient Technologies Studio for OrientDB Server Community Edition Cross-Site Request Forgery Vulnerability

Orient Technologies Studio for OrientDB Server Community Edition is a community edition of OrientDB Server from Orient Technologies, UK. A cross-site request forgery vulnerability exists in Orient Technologies Studio for OrientDB Server Community Edition, which allows remote attackers to construc...

Cross site scripting

The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting XSS attacks via a base64 encoded data URI, as demonstrated by the 1 returnUrl parameter to showrechis.php and...

CVE-2015-5956

The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting XSS attacks via a base64 encoded data URI, as demonstrated by the 1 returnUrl parameter to showrechis.php and...

Android Mercury Browser Intent URI Scheme and Directory Traversal Vulnerability

This module exploits an unsafe intent URI scheme and directory traversal found in Android Mercury Browser version 3.2.3. The intent allows the attacker to invoke a private wifi manager activity, which starts a web server for Mercury on port 8888. The webserver also suffers a directory traversal...

YesWiki 0.2 - Path Traversal Vulnerability

Exploit for php platform in category web applications Exploit Title: YESWIKI 0.2 - Path Traversal Date: 2015-09-02 Exploit Author: HaHwul Exploit Author Blog: http://www.codeblack.net Vendor Homepage: http://yeswiki.net Software Link: https://github.com/YesWiki/yeswiki Version: yeswiki 0.2 Tested...

Android Mercury browser vulnerability analysis-vulnerability warning-the black bar safety net

0 x 0 0 Mercury browser description Mercury browser is 2 0 1 0 years on the shelves of a veteran of the intelligent terminal browser, its software interface is the Chrome like simple wind. Its rich features include: private browsing, PC Page mode, plug-in, gesture control, powerful download tool,...