Shopify: Open redirect using checkout_url

Hi , I would like to report an open redirect issue in .myshopify.com/account/logout and .myshopify.com/account/login Details: Your application allow redirecting to https://checkout.shopify.com/ through https://.myshopify.com/account/logout?returnurl= The page https://checkout.shopify.com/ will...

PHP: sets environmental variable based on user supplied Proxy request header

It was discovered that PHP did not properly protect against the HTTPPROXY variable name clash. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a PHP script to an attacker-controlled proxy via a malicious HTTP request...

CVE-2016-5253

Mozilla Firefox updater on Windows (pre-48.0) is affected. The Updater can be abused via the callback application-path parameter and a hard link to write arbitrary files (local privilege escalation). A fix is to upgrade to Firefox 48.0 or later; apply vendor advisories for the exact patched versi...

Mozilla: Buffer overflow rendering SVG with bidirectional content (MFSA 2016-64)

Heap-based buffer overflow in the nsBidi::BracketData::AddOpening function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via directional content in an SVG document...

UBUNTU-CVE-2016-2838

Heap-based buffer overflow in the nsBidi::BracketData::AddOpening function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via directional content in an SVG document...

AXIS Multiple Products - Authenticated Remote Command Execution via devtools Vector

Exploit for linux platform in category web applications Advisory Information ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + Title: AXIS Multiple Products Authenticated Remote Command Execution via devtools vector + Vendor: AXIS Communications + Research and Advisory: Orwelllabs ...

Vector 2 - Base64 encoded String, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Vector 2 published at the 'play' market has multiple vulnerabilities...

CVE-2016-3574

Unspecified vulnerability in the Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Outside In Filters, a different vulnerability than CVE-2016-3575, CVE-2016-357...

Buffer overflow

Unspecified vulnerability in the Oracle Retail Integration Bus component in Oracle Retail Applications 13.0, 13.1, 13.2, 14.0, 14.1, and 15.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Install...

CVE-2016-5437

Unspecified vulnerability in Oracle MySQL 5.7.12 and earlier allows remote administrators to affect availability via vectors related to Server: Log...

UBUNTU-CVE-2016-4583

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document...

CVE-2016-3485

Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows local users to affect integrity via vectors related to Networking...

Foreman Information Disclosure Vulnerability (CNVD-2016-05037)

Foreman is a set of lifecycle management tools for use in physical and virtual servers. A security vulnerability exists in Foreman that could be exploited by an attacker to submit a special request for sensitive information...

Microsoft Office Memory Corruption Vulnerability

A remote code execution vulnerability exists in Microsoft Office software when the Office software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on wit...

Microsoft Office Memory Corruption Vulnerability

A remote code execution vulnerability exists in Microsoft Office software when the Office software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on wit...

Weakness with cookie encryption

PMASA-2016-29 Announcement-ID: PMASA-2016-29 Date: 2016-07-07 Summary Weakness with cookie encryption Description A pair of vulnerabilities were found affecting the way cookies are stored. The decryption of the username/password is vulnerable to a padding oracle attack. The can allow an attacker...

Thunderbird Data Compromise

The use of this feature after release in the mozilla::DOMSVGLength::GetTearOff function in Mozilla Firefox, Firefox ESR, and Thunderbird allows malicious actors operating remotely to execute arbitrary code or cause service failures errors when working with dynamic memory through SVG animations th...

Microsoft SQL Server Information Disclosure

There is a vulnerability in SQL Server that can cause a service failure. If exploited successfully, a malicious individual can trigger a server failure before it can be restarted manually...

Google Chrome Data Compromise

The use of this feature after release in SVG implementation for Blink for Google Chrome allows malicious actors operating remotely to trigger service failures or otherwise affect the system by using incorrect caching related to animations...

Thunderbird Information Disclosure

The Thunderbird email client contains a vulnerability related to errors in the implementation of the SVG filter. This vulnerability allows a malicious actor to gain access to confidential information about displacement and correlations, as well as to circumvent domain restriction policies. The...