7444 matches found
Remote code execution
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the...
CVE-2018-7160
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the...
CVE-2018-7160
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the...
[SECURITY] Fedora 26 Update: firefox-60.0-4.fc26
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...
[SECURITY] Fedora 28 Update: firefox-60.0-4.fc28
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...
Bypassing Mitigations by Attacking JIT Server in Microsoft Edge
Posted by Ivan Fratric, Project Zero With Windows 10 Creators Update, Microsoft introduced a new security mitigation in Microsoft Edge: Arbitrary Code Guard ACG. When ACG is applied to a Microsoft Edge Content Process, it makes it impossible to allocate new executable memory within a process or...
RT-AC68U vulnerable to cross-site scripting
Overview RT-AC68U provided by ASUS Japan Inc. is a wireless LAN router. RT-AC68U contains a cross-site scripting vulnerability CWE-79. Yuto MAEDA of University of Tsukuba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...
Design/Logic Flaw
An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/resources/hudson/plugins/emailext/ExtendedEmailPublisher/global.groovy and ExtendedEmailPublisherDescriptor.java that allows attackers with control of a Jenkins administrator's w...
CVE-2018-1000176
An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/resources/hudson/plugins/emailext/ExtendedEmailPublisher/global.groovy and ExtendedEmailPublisherDescriptor.java that allows attackers with control of a Jenkins administrator's w...
Microsoft Internet Explorer CVE-2018-8126 Security Bypass Vulnerability
Description Microsoft Internet Explorer is prone to a security-bypass vulnerability. Successfully exploiting this issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions. This may lead to other attacks. Internet Explorer 11 is vulnerable. Technologies...
Microsoft Exchange Server CVE-2018-8153 Spoofing Vulnerability
Description Microsoft Exchange Server is prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies Affected Microsoft Exchan...
Zomato: XSS in "explore-keywords-dropdown" results.
It seems that people have exploited this vulnerability before on this website, however, it remains unpatched, so here I am reporting the vulnerability. A XSS vulnerability exists when a restaurant or dish is created with a malicious name. The title of the dish or restaurant is not properly filter...
WordPress WF Cookie Consent 1.1.3 Plugin - Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: WF Cookie Consent - Authenticated Persistent Cross-Site Scripting Exploit Author: B0UG Vendor Homepage: http://www.wunderfarm.com/ Software Link: https://en-gb.wordpress.org/plugins/wf-cookie-consent/ Version: Tested on version...
firefox security update
CentOS Errata and Security Advisory CESA-2018:1098 An update for firefox is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
Debian DSA-4182-1 : chromium-browser - security update
Several vulnerabilities have been discovered in the chromium web browser. - CVE-2018-6056 lokihardt discovered an error in the v8 JavaScript library. - CVE-2018-6057 Gal Beniamini discovered errors related to shared memory permissions. - CVE-2018-6060 Omair discovered a use-after-free issue in...
[SECURITY] [DSA 4182-1] chromium-browser security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4182-1 [email protected] https://www.debian.org/security/ Michael Gilbert April 28, 2018 https://www.debian.org/security/faq -...
macOS : Apple Safari 11.1 APPLE-SA-2018-04-24-3 Multiple Vulnerabilities
The version of Apple Safari installed on the remote macOS or Mac OS X host is 11.1, but is missing the security fix APPLE-SA-2018-04-24-3. It is, therefore, affected by multiple vulnerabilities as described in the HT208741 security advisory. C Tenable Network Security, Inc. include"compat.inc"; i...
JVN#85531148: WordPress plugin "Events Manager" vulnerable to cross-site scripting
The WordPress plugin "Events Manager" provided by NetWebLogic contains a stored cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on a logged in user's web browser. Solution Update the plugin Update the plugin according to the information provided by the...
Quixplorer 2.4.1 Beta Cross Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: Reflected XSS in quixplorer-2.4.1beta Google Dork: intitle:"My Download Server" Exploit Author: Adriano Marcio Monteiro @adrianomarcmont Exploit Author Site: https://www.brztec.com Exploit Author E-mail: email protected Vendor...