CVE-2018-5167

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

Code injection

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

CVE-2018-5167

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

CVE-2018-5167

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

CVE-2018-5167

The CVE-2018-5167 issue affects Mozilla Firefox prior to version 60, where the web console and JavaScript debugger fail to sanitize all hyperlink-output. This can cause chrome: and javascript: links to render as active hyperlinks, enabling potential user interaction with internal pages via malici...

CVE-2018-5167

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

CVE-2018-5167: Improper Input Validation

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

Mozilla Firefox Design Vulnerability (CNVD-2018-11791)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 60, which stems from a failure of the web console and JavaScript debugger to filter all output with hyperlinks. A remote...

CVE-2016-10532

console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This means that if console-io was running...

CVE-2016-10532

The CVE-2016-10532 issue concerns the console-io module, specifically versions 2.2.13 and earlier, where socket.io is not configured to require authentication. This allows an attacker to connect via WebSocket, bypass authentication, and execute commands with the same privileges as the console-io ...

Quest KACE System Management Appliance 8.0 (Build 8.0.318) XSS / Traversal / Code Execution / SQL Injection

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Quest KACE System Management Appliance Multiple Vulnerabilities 1. Advisory Information Title: Quest KACE System Management Appliance Multiple Vulnerabilities Advisory ID: CORE-2018-0004 Advisory URL:...

ovirt-engine: account enumeration through login to web console

The ovirt-engine web console login form returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts...

CVE-2018-1073

The ovirt-engine web console login form returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts...

CVE-2018-5167

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

UBUNTU-CVE-2018-5167

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

PT-2018-2999

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 60 Description The issue is related to the web console and JavaScript debugger not properly sanitizing output, which can lead to displaying internal chrome pages as active hyperlinks. This could allow malicious sites ...

Exploit for Improper Access Control in Rubyonrails Web_Console

No d...

CVE-2018-1000163

Floodlight version 1.2 and earlier contains a Cross Site Scripting XSS vulnerability in the web console that can result in javascript injections into the web page. This attack appears to be exploitable via the victim browsing the web console...

Cross site scripting

Floodlight version 1.2 and earlier contains a Cross Site Scripting XSS vulnerability in the web console that can result in javascript injections into the web page. This attack appears to be exploitable via the victim browsing the web console...

CVE-2018-1000163

Floodlight version 1.2 and earlier contains a Cross Site Scripting XSS vulnerability in the web console that can result in javascript injections into the web page. This attack appears to be exploitable via the victim browsing the web console...