Blog2Social < 6.9.10 - Subscriber+ SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers PoC Run the script below in the web browser console while being logged in as a subscriber and on the Blog2Social...

Google Chrome Resource Management Error Vulnerability (CNVD-2022-81238)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a Resource Management Error vulnerability that stems from a post-release reuse in the Browser Tag. An attacker could exploit this vulnerability to cause the browser to crash...

JVN#78862034: BookStack vulnerable to cross-site scripting

BookStack contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who is accessing the site using the API of the product. Solution Update the Software Update the software to the latest version according to the information...

[SECURITY] Fedora 35 Update: firefox-105.0.1-1.fc35

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

Cross site scripting

IBM Rational Change 5.3 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using the SUPPTEMPLATEFLAG parameter in a specially-crafted URL to execute script in a victim's Web browser within the security...

Google Chrome Survey Memory Misreference Vulnerability (CNVD-2022-88285 )

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in versions of Google Chrome prior to 106.0.5249.62, which stems from a confusion in the instructions responsible for freeing memory in Survey. An attacker could exploit the vulnerability t...

Google Chrome Media Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in versions of Google Chrome prior to 106.0.5249.62, which stems from a mix-up in instructions responsible for freeing memory in Media. An attacker could exploit the vulnerability potential...

Fedora: Security Advisory for firefox (FEDORA-2022-25e330a435)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Google Chrome Survey Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in versions of Google Chrome prior to 106.0.5249.62, which stems from a confusion in the instructions responsible for freeing memory in Survey. An attacker could exploit the vulnerability t...

Google Chrome Import Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in versions of Google Chrome prior to 106.0.5249.62, which stems from a confusion in the instruction responsible for freeing memory in Import. An attacker could exploit the vulnerability to...

Google Chrome Resource Management Error Vulnerability (CNVD-2022-81239)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a Resource Management Error vulnerability that originates from a confusion in the instructions responsible for freeing memory in Assistant. An attacker could exploit this vulnerability to cause a program...

[SECURITY] Fedora 37 Update: firefox-105.0.1-1.fc37

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

USN-5642-1: WebKitGTK vulnerabilities

Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and...

USN-5642-1 webkit2gtk vulnerabilities

Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

ALSA-2022:6700 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.3.0 ESR. Security Fixes: Mozilla: Bypassing FeaturePolicy restrictions on transient pages CVE-2022-40959 Mozilla: Data-race when parsing...

Security Bulletin: IBM Smart Analytics System 5600 clients affected by vulnerabilities in IBM JRE (CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823)

Abstract These vulnerabilities are only applicable to Java deployments where untrusted code may be executed e.g. Java applets running in a web browser. Content VULNERABILITY DETAILS CVE IDs: CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823 DESCRIPTION: The IBM Smart Analytics System 560...

Security Bulletin: IBM Security Access Manager for Enterprise Single Sign On Cross Site Scripting Vulnerability (CVE-2013-6745)

Abstract A dynamic web form is vulnerable to a cross-site scripting XSS attack Content VULNERABILITY DETAILS: CVE ID: CVE-2013-6745 DESCRIPTION: A dynamic web form is vulnerable to a cross-site scripting XSS attack. A remote attacker could exploit this vulnerability using JavaScript code to injec...

Cross-Site Scripting: The Real WordPress Supervillain

Vulnerabilities are a fact of life for anyone managing a website, even when using a well-established content management system like WordPress. Not all vulnerabilities are equal, with some allowing access to sensitive data that would normally be hidden from public view, while others could allow a...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input (CVE-2016-0399)

Summary IBM Maximo Asset Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using the a specially-crafted URL to execute script in a victim's Web browser within the security context of the...