USN-3460-1: WebKitGTK+ vulnerabilities

A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service...

Microsoft SharePoint Server CVE-2017-11777 Cross Site Scripting Vulnerability

Description Microsoft SharePoint Server is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...

Mozilla Firefox ESR < 52.4

The version of Firefox ESR installed on the remote Windows host is prior to 52.4. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-22 advisory. - Mozilla developers and community members Christoph Diehl, Jan de Mooij, Jason Kratzer, Randell Jesup, Tom Ritter,...

CentOS Update for firefox CESA-2017:2831 centos7

Check the version of firefox SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882778";...

USN-3435-1: Firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, obtain sensitive information, bypass phishing and malware protection, spoof the origin in modal dialogs,...

[SECURITY] Fedora 26 Update: firefox-56.0-2.fc26

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

CentOS 6 / 7 : firefox (CESA-2017:2831)

An update for firefox is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

[SECURITY] Fedora 27 Update: chromium-61.0.3163.100-1.fc27

Chromium is an open-source web browser, powered by WebKit Blink...

[SECURITY] Fedora 27 Update: firefox-55.0.3-1.fc27

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

RHEL 6 / 7 : firefox (RHSA-2017:2831)

The remote Redhat Enterprise Linux 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2017:2831 advisory. Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 52.4.0 ESR. Security Fixes: Multiple flaws were...

Important: Red Hat Security Advisory: chromium-browser security update

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

OWASP AntiSamy CVE-2017-14735 Cross Site Scripting Vulnerability

Description OWASP AntiSamy is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the...

The Great DOM Fuzz-off of 2017

Posted by Ivan Fratric, Project Zero Introduction Historically, DOM engines have been one of the largest sources of web browser bugs. And while in the recent years the popularity of those kinds of bugs in targeted attacks has somewhat fallen in favor of Flash which allows for cross-browser exploi...

Self Cross-site Scripting (XSS)

concrete5 is vulnerable to cross-site scripting XSS attacks. The library does not properly escape the folder name. A malicious user can then trick another user into injecting and executing arbitrary code in their web browser...

CVE-2017-8733

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to trick a user into believing that the user was visiting a legitimate websit...

Microsoft Edge CVE-2017-8735 Spoofing Vulnerability

Description Microsoft Edge is prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies Affected Microsoft Edge...

Microsoft Internet Explorer CVE-2017-8733 Spoofing Vulnerability

Description Microsoft Internet Explorer is prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Internet Explorer 9, 10 and 11 are...

Microsoft Edge CVE-2017-8724 Spoofing Vulnerability

Description Microsoft Edge is prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies Affected Microsoft Edge...

DIGISOL DG-BG1100N ROM-0 Backup File Disclosure

Exploit Title : ROM-0 Backup File Disclosure on DIGISOL Date : 24-08-2017 Exploit Author : Sudin nk Vendor Homepage: http://www.digisol.com Tested Routers : DG-BG1100N ADSL 2/2+ Modem Wifi Router Tested on : Parrotsec x8664 ROM-0 Backup File Disclosure on DIGISOL A dangerous vulnerability present...

8 More Chrome Extensions Hijacked to Target 4.8 Million Users

Google's Chrome web browser Extensions are under attack with a series of developers being hacked within last one month. Almost two weeks ago, we reported how unknown attackers managed to compromise the Chrome Web Store account of a developer team and hijacked Copyfish extension, and then modified...