7444 matches found
Information Disclosure
atomic-openshift is vulnerable to information disclosure. An origin validation vulnerability was found in OpenShift Enterprise. An attacker could potentially access API credentials stored in a web browser's localStorage if anonymous access was granted to a service/proxy or pod/proxy API for a...
Cross-site Scripting (XSS)
Mozilla Firefox and Thunderbird is vulnerable to cross-site scripting XSS. The use of valueOf method to shadow the location object window.location is not prevented, allowing for remote attackers to inject arbitrary Javascript into a victim's web browser via a malicious plugin...
Denial Of Service (Dos)
IcedTea-Web is vulnerable to denial of service. A web browser with the IcedTea-Web plug-in crashes when visiting a malicious web page due to an uninitialized pointer use. The vulnerability could potentially disclose memory containing confidential information, or allow remote attackers to execute...
Information Disclosure
icedtea-web is vulnerable to information disclosure attacks. The vulnerability exists as the LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages between a Java applet and a web browser by pre-creating a temporary...
Ubuntu 18.04 LTS : WebKitGTK+ vulnerabilities (USN-3854-1)
The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3854-1 advisory. A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote...
LogonTracer Cross-Site Scripting Vulnerability
LogonTracer is a visual Windows log analysis tool that checks for malicious logins by analyzing Windows Active Directory event logs. A cross-site scripting vulnerability exists in LogonTracer version 1.2.0 and earlier versions, which can be exploited by remote attackers to execute arbitrary scrip...
CVE-2018-0666
Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be...
Design/Logic Flaw
Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be...
Microsoft Office SharePoint CVE-2019-0556 Cross Site Scripting Vulnerability
Description Microsoft Office SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...
Fedora 28 : monitorix (2018-3b67a68763)
Prior Monitorix versions are vulnerable to cross-site scripting XSS, caused by improper validation of user-supplied input by the monitorix.cgi file. A remote attacker could exploit this vulnerability using some of the arguments provided graph= or when= in a specially crafted URL to execute script...
CVE-2018-1000629
Battelle V2I Hub 2.5.1 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by api/SystemConfigActions.php?action=add and the index.php script. A remote attacker could exploit this vulnerability using the parameterName or loginusername parameter in a...
CVE-2018-19615
Rockwell Automation Allen-Bradley PowerMonitor 1000 all versions. A remote attacker could inject arbitrary code into a targeted userâs web browser to gain access to the affected device...
CVE-2018-19615
CVE-2018-19615 affects Rockwell Automation Allen-Bradley PowerMonitor 1000 (all versions). The vulnerability is described as Cross-Site Scripting due to improper neutralization of input during web page generation, enabling a remote attacker to inject arbitrary code into a targeted user’s browser ...
JVN#96493183: GROWI vulnerable to cross-site scripting
GROWI provided by WESEEK, Inc. contains a cross-site scripting vulnerability CWE-79. The settings option for enabling and disabling the measures against cross-site scripting "Enable XSS prevention" option was introduced in v3.1.12. However, there was an issue with the implementation where the...
firefox security update
CentOS Errata and Security Advisory CESA-2018:3831 An update for firefox is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
[SECURITY] Fedora 29 Update: firefox-64.0-4.fc29
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...
[SECURITY] Fedora 28 Update: firefox-64.0-4.fc28
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...
Debian: Security Advisory (DLA-1605-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Internet Explorer Scripting Engine Memory Corruption Vulnerability
Internet Explorer is a web browser from Microsoft. Formerly known as Microsoft Internet Explorer prior to version 6 and Windows Internet Explorer versions 7, 8, 9, 10, 11, or IE for short. A memory corruption vulnerability exists in the way memory objects are handled in the Internet Explorer...
CVE-2018-18347
CVE-2018-18347 affects Chromium/WebKit’s Navigation component. A flaw in handling failed navigations with invalid URLs allowed a remote attacker to craft an HTML page that tricks a user into running JavaScript in an arbitrary origin. The Arch Linux advisory (ASA-201812-2) and Debian advisories no...