Subrion CMS 4.0.5 - Cross-Site Request Forgery Bypass Persistent Cross-Site Scripting

Subrion CMS 4.0.5 - Cross-Site Request Forgery Bypass Persistent Cross-Site Scripting Exploit Title: Subrion CMS 4.0.5 - CSRF Bypass to Persistent XSS and Add-Admin Date: 15-10-2016 Software Link: http://www.subrion.org/download/ Vendor: http://www.subrion.org Google Dork: "Powered by Subrion CMS...

Microsoft Teams help & learning

None None...

Mozilla Firefox and Firefox ESR Heap Buffer Overflow Vulnerability

Mozilla Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. A heap buffer overflow vulnerability exists in the Mozilla Firefox and Firefox ESR 'nsBMPEncoder::AddImageFrame' function, which allows remote attackers to construct a malicious WEB page that can...

browsers Internet Explorer and Information Disclosure

The vulnerability of Internet Explorer and Microsoft Edge is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain confidential information through a specially crafted web page...

Microsoft Edge Code Execution

The vulnerability of Microsoft Edge arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or trigger a service failure memory corruption through a specially crafted web page...

Microsoft Internet Explorer and Edge CVE-2016-3291 Information Disclosure Vulnerability

Description Microsoft Internet Explorer and Edge are prone to an information disclosure vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Successful exploits will allow attackers to obtain sensitive information that may aid in...

Microsoft Internet Explorer and Edge CVE-2016-3325 Information Disclosure Vulnerability

Description Microsoft Internet Explorer and Edge are prone to an information disclosure vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Successful exploits will allow attackers to obtain sensitive information that may aid in...

ZKTeco ZKAccess Security System 5.3.1 - Persistent Cross-Site Scripting

Exploit for jsp platform in category web applications !-- ZKTeco ZKAccess Security System 5.3.1 Stored XSS Vulnerability Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd Product web page: http://www.zkteco.com Affected version: 5.3.12252 Summary: ZKAccess Systems ar...

Microsoft Edge Code Execution

The vulnerability in Microsoft Edge’s Chakra JavaScript engine is caused by a buffer overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code via a specially crafted web page from a remote location...

Microsoft Edge Information Disclosure

The vulnerability of the VBScript kernel in Microsoft Edge browsers is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain confidential information from the process’s memory through a specially crafted web pa...

CVE-2016-3329

Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to determine the existence of files via a crafted webpage, aka "Internet Explorer Information Disclosure Vulnerability."...

PT-2016-2564

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 9 through 11 Microsoft Edge affected versions not specified Description The issue is related to the improper handling of objects in memory and page content, which could allow a remote attacker to determine...

Threat Outbreak Alert RuleID24041: Email Messages Distributing Malicious Software on August 3, 2016

Medium Alert ID: 48360 First Published: 2016 August 3 14:08 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24041 may contain the following files: Name | Si...

Microsoft Lync Attendee User Data Compromise

A vulnerability that allows for remote execution of code exists in vulnerable components and is related to the processing of specially crafted font files. Exploiting this vulnerability enables remote execution of code, provided that the user opens a specially crafted file or webpage. Exploiting...

Microsoft Lync Server Data Compromise

A vulnerability that allows for remote execution of code exists in vulnerable components and is related to the processing of specially crafted font files. Exploiting this vulnerability enables remote execution of code, provided that the user opens a specially crafted file or webpage. Exploiting...

Mac OS X iOS Code Execution

The vulnerability of the OpenGL component in the Mac OS X and iOS operating systems arises from buffer overflows. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely or cause a service failure memory corruption by using a specially crafted web page...

Mapbox: XSS on www.mapbox.com/authorize/ because of open redirect at /core/oauth/auth

Description --- When you load the endpoint https://www.mapbox.com/authorize/ a GET request is made to the endpoint https://www.mapbox.com/core/oauth/auth with the parameters passed in the request to https://www.mapbox.com/authorize/. If you only send the parameter redirecturi in the request to...

Google Chrome Autofill Memory Misreference Vulnerability

Google Chrome is a popular web browser. A memory misreference vulnerability exists in Google Chrome Autofill, which allows remote attackers to exploit the vulnerability to construct a malicious web page and trick users into parsing it, which can crash the application or execute arbitrary code...

Apple iOS WebKit Information Disclosure Vulnerability (CNVD-2016-03339)

Apple iOS is the United States Apple Apple company for mobile devices developed by a set of operating systems. WebKit is KDE, Apple Apple, Google Google and other companies jointly developed a set of open source Web browser engine, currently used by Apple Safari and Google Chrome and other...

Windows Graphics Component Information Disclosure Vulnerability

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise a user’s system. There are multiple ways an attacker could exploit...