all things security
Showing 26 - 50 of 635 RSS Feed

JavaScript Files

Bassmaster Batch Arbitrary JavaScript Injection Remote Code Execution
Posted Oct 30, 2016
Authored by mr_me, Jarda Kotesovec | Site metasploit.com

This Metasploit module exploits an un-authenticated code injection vulnerability in the bassmaster nodejs plugin for hapi. The vulnerability is within the batch endpoint and allows an attacker to dynamically execute JavaScript code on the server side using an eval. Note that the code uses a '\x2f' character so that we hit the match on the regex.

tags | exploit, javascript
advisories | CVE-2014-7205
MD5 | 7af2c30d42d21be807ca574c8e53433d
Red Hat Security Advisory 2016-2117-01
Posted Oct 26, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-2117-01 - OpenStack's File Share Service provides the means to easily provision shared file systems that can be consumed by multiple instances. These shared file systems are provisioned from pre-existing, back-end volumes. The UI component provides the dashboard plugin for the service. Security Fix: A cross-site scripting flaw was discovered in openstack-manila-ui's Metadata field contained in its "Create Share" form. A user could inject malicious HTML/JavaScript code that would then be reflected in the "Shares" overview. Remote, authenticated, but unprivileged users could exploit this vulnerability to steal session cookies and escalate their privileges.

tags | advisory, remote, javascript, xss
systems | linux, redhat
advisories | CVE-2016-6519
MD5 | 86f2ea35d32d03c383af5f3531c9f675
Red Hat Security Advisory 2016-2115-01
Posted Oct 26, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-2115-01 - OpenStack's File Share Service provides the means to easily provision shared file systems that can be consumed by multiple instances. These shared file systems are provisioned from pre-existing, back-end volumes. The UI component provides the dashboard plugin for the service. Security Fix: A cross-site scripting flaw was discovered in openstack-manila-ui's Metadata field contained in its "Create Share" form. A user could inject malicious HTML/JavaScript code that would then be reflected in the "Shares" overview. Remote, authenticated, but unprivileged users could exploit this vulnerability to steal session cookies and escalate their privileges.

tags | advisory, remote, javascript, xss
systems | linux, redhat
advisories | CVE-2016-6519
MD5 | c85dfcd5fbb18fa75c6dcb2483124715
Red Hat Security Advisory 2016-2116-01
Posted Oct 26, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-2116-01 - OpenStack's File Share Service provides the means to easily provision shared file systems that can be consumed by multiple instances. These shared file systems are provisioned from pre-existing, back-end volumes. The UI component provides the dashboard plugin for the service. Security Fix: A cross-site scripting flaw was discovered in openstack-manila-ui's Metadata field contained in its "Create Share" form. A user could inject malicious HTML/JavaScript code that would then be reflected in the "Shares" overview. Remote, authenticated, but unprivileged users could exploit this vulnerability to steal session cookies and escalate their privileges.

tags | advisory, remote, javascript, xss
systems | linux, redhat
advisories | CVE-2016-6519
MD5 | 2dc4a529f01ea5e16ab61b6455d64753
Ubuntu Security Notice USN-3079-1
Posted Sep 14, 2016
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3079-1 - A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

tags | advisory, remote, web, denial of service, arbitrary, javascript, code execution, xss
systems | linux, ubuntu
advisories | CVE-2016-1854, CVE-2016-1856, CVE-2016-1857, CVE-2016-1858, CVE-2016-1859, CVE-2016-4583, CVE-2016-4585, CVE-2016-4586, CVE-2016-4588, CVE-2016-4589, CVE-2016-4590, CVE-2016-4591, CVE-2016-4622, CVE-2016-4623, CVE-2016-4624, CVE-2016-4651
MD5 | 3be27f233c288d5e725fda88e4f9bee5
CodeWarrior 0.3
Posted Sep 13, 2016
Authored by coolervoid

CodeWarrior is a manual code and static analysis tool. It has many modules, one for each common language like PHP, ASP, Ruby, C/C++, Java and Javascript. Each module has rules in raw text with parameters like description, type, reference, relevance and match (regex to detect pattern). You can also create your own rules.

tags | tool, php, javascript, asp, ruby
systems | unix
MD5 | 125797229a978f1c58e1d352c00eb34e
Htcap Analysis Tool 1.0.1
Posted Aug 26, 2016
Authored by Filippo Cavallarin

Htcap is a web application analysis tool for detecting communications between javascript and the server. It crawls the target application and maps ajax calls, dynamically inserted scripts, websockets calls, dynamically loaded resources and some interesting elements. The generated report is meant to be a good starting point for a manual web application security audit. Htcap is written in python and uses phantomjs to load pages injecting a probe that analyzes javascript behaviour. Once injected, the probe, overrides native javascript methods in order to intercept communications and DOM changes. It also simulates user interaction by firing all attached events and by filling html inputs.

Changes: This release is focused on stability, bugfixes, and minor improvements.
tags | tool, web, javascript, sniffer, python
MD5 | a4f577e9f89d71d5f6c3d79d81ba29d4
Red Hat Security Advisory 2016-1596-01
Posted Aug 11, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-1596-01 - Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY principle. Security Fix: A cross-site scripting flaw was found in Django. An attacker could exploit the unsafe usage of JavaScript's Element.innerHTML to forge content in the admin's add/change related popup. Element.textContent is now used to prevent XSS data execution.

tags | advisory, web, javascript, xss, python
systems | linux, redhat
advisories | CVE-2016-6186
MD5 | 1bee7be03e616f5ce088093d21a97c91
Red Hat Security Advisory 2016-1595-01
Posted Aug 11, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-1595-01 - Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY principle. Security Fix: A cross-site scripting flaw was found in Django. An attacker could exploit the unsafe usage of JavaScript's Element.innerHTML to forge content in the admin's add/change related popup. Element.textContent is now used to prevent XSS data execution.

tags | advisory, web, javascript, xss, python
systems | linux, redhat
advisories | CVE-2016-6186
MD5 | e7b665d56d6cdea27c61a88d8794ae05
Red Hat Security Advisory 2016-1594-01
Posted Aug 11, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-1594-01 - Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY principle. Security Fix: A cross-site scripting flaw was found in Django. An attacker could exploit the unsafe usage of JavaScript's Element.innerHTML to forge content in the admin's add/change related popup. Element.textContent is now used to prevent XSS data execution.

tags | advisory, web, javascript, xss, python
systems | linux, redhat
advisories | CVE-2016-6186
MD5 | ae57de7f8e8b4cb4d505d6f3bdc59790
Red Hat Security Advisory 2016-1583-01
Posted Aug 9, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-1583-01 - Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. Security Fix: A regular expression denial of service flaw was found in Minimatch. An attacker able to make an application using Minimatch to perform matching using a specially crafted glob pattern could cause the application to consume an excessive amount of CPU.

tags | advisory, denial of service, javascript
systems | linux, redhat
advisories | CVE-2016-1000023
MD5 | 4229df6159430f784197b10d23734fb5
Red Hat Security Advisory 2016-1582-01
Posted Aug 9, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-1582-01 - Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. Security Fix: A regular expression denial of service flaw was found in Minimatch. An attacker able to make an application using Minimatch to perform matching using a specially crafted glob pattern could cause the application to consume an excessive amount of CPU.

tags | advisory, denial of service, javascript
systems | linux, redhat
advisories | CVE-2016-1000023
MD5 | 78897d66888808d3dcb5846014598576
VMware vSphere Hypervisor (ESXi) HTTP Response Injection
Posted Aug 5, 2016
Authored by Matthias Deeg

The SySS GmbH found out that the web server of VMware ESXi 6 is vulnerable to HTTP response injection attacks, as arbitrarily supplied URL parameters are copied in the HTTP header Location of the server response without sufficient input validation. Thus, an attacker can create a specially crafted URL with a specific URL parameter that injects attacker-controlled data to the response of the VMware ESXi web server. Depending on the context, this allows different attacks. If such a URL is visited by a victim, it may for example be possible to set web browser cookies in the victim's web browser, execute arbitrary JavaScript code, or poison caches of proxy servers.

tags | exploit, web, arbitrary, javascript
advisories | CVE-2016-5331
MD5 | ede1d4f2aa61104f3c3b4333be7aa391
Red Hat Security Advisory 2016-1484-01
Posted Jul 26, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-1484-01 - Red Hat Satellite is a system management tool for Linux-based infrastructures. It allows for provisioning, monitoring, and the remote management of multiple Linux deployments with a single, centralized tool. Security Fix: A stored cross-site scripting flaw was found in the way spacewalk-java displayed monitoring probes. An attacker can embed HTML and Javascript in the values for RHNMD User or Filesystem parameters in Satellite, allowing them to inject malicious content into the web page that is then displayed with that probe data.

tags | advisory, remote, web, javascript, xss
systems | linux, redhat
advisories | CVE-2016-3080, CVE-2016-3097
MD5 | e81be85d90a8a40a5304b949c33f3d47
Red Hat Security Advisory 2016-1380-01
Posted Jul 5, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-1380-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix: The nodejs-qs module has the ability to create sparse arrays during parsing. By specifying a high index in a querystring parameter it is possible to create a large array that will eventually take up all the allocated memory of the running process, resulting in a crash.

tags | advisory, javascript
systems | linux, redhat
advisories | CVE-2014-7191
MD5 | b3fd89193c0dc8693f2e0bc388237b00
Microsoft Internet Explorer 11 Garbage Collector Attribute Type Confusion
Posted Jun 17, 2016
Authored by SkyLined

With MS16-063, Microsoft has patched CVE-2016-0199 which relates to a memory corruption bug in the garbage collector of the JavaScript engine used in Internet Explorer 11.

tags | exploit, javascript
advisories | CVE-2016-0199
MD5 | 7d748d12572a7120313c25df22e7d62c
Json2Html Cross Site Scripting
Posted Jun 16, 2016
Authored by David Silveiro

Json2Html javascript library suffers from a cross site scripting vulnerability.

tags | exploit, javascript, xss
MD5 | ea4c9f324befba8301c0776711da1f35
Ubuntu Security Notice USN-2936-3
Posted May 19, 2016
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2936-3 - USN-2936-1 fixed vulnerabilities in Firefox. The update caused an issue where a device update POST request was sent every time about:preferences#sync was shown. This update fixes the problem. Christian Holler, Tyson Smith, Phil Ringalda, Gary Kwong, Jesse Ruderman, Mats Palmgren, Carsten Book, Boris Zbarsky, David Bolter, Randell Jesup, Andrew McCreight, and Steve Fink discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. An invalid write was discovered when using the JavaScript .watch() method in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. Various other issues were also addressed.

tags | advisory, denial of service, arbitrary, javascript, vulnerability
systems | linux, ubuntu
advisories | CVE-2016-2807, CVE-2016-2808, CVE-2016-2814, CVE-2016-2816, CVE-2016-2817, CVE-2016-2820
MD5 | f459fbea49906c9e616d8a74a6e312fa
Ubuntu Security Notice USN-2936-2
Posted May 2, 2016
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2936-2 - USN-2936-1 fixed vulnerabilities in Firefox. The update caused Firefox to crash on startup with the Oxygen GTK theme due to a pre-existing bug in the Oxygen-GTK3 theme engine. This update fixes the problem. Various other issues were also addressed.

tags | advisory, remote, web, denial of service, overflow, arbitrary, javascript, vulnerability, xss
systems | linux, ubuntu
advisories | CVE-2016-2807, CVE-2016-2808, CVE-2016-2814, CVE-2016-2816, CVE-2016-2817, CVE-2016-2820
MD5 | 3bf270eb158f27c30fe86ab140838c9c
Apache OpenMeetings 3.0.7 Cross Site Scripting
Posted Mar 25, 2016
Authored by Andreas Lindh

When creating an event, it is possible to create clickable URL links in the event description. These links will be present inside the event details once a participant enters the room via the event. It is possible to create a link like "javascript:alert('xss')", which will execute once the link is clicked. As the link is placed within an <a> tag, the actual link is not visible to the end user which makes it hard to tell if the link is legit or not. Apache OpenMeetings versions 1.9.x through 3.0.7 are affected.

tags | advisory, javascript
advisories | CVE-2016-2163
MD5 | a0d417c68e6733e3bb7f64ccfefff0e7
Ubuntu Security Notice USN-2937-1
Posted Mar 22, 2016
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2937-1 - A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

tags | advisory, remote, web, denial of service, arbitrary, javascript, code execution, xss
systems | linux, ubuntu
advisories | CVE-2014-1748, CVE-2015-1071, CVE-2015-1076, CVE-2015-1081, CVE-2015-1083, CVE-2015-1120, CVE-2015-1122, CVE-2015-1127, CVE-2015-1153, CVE-2015-1155, CVE-2015-3658, CVE-2015-3659, CVE-2015-3727, CVE-2015-3731, CVE-2015-3741, CVE-2015-3743, CVE-2015-3745, CVE-2015-3747, CVE-2015-3748, CVE-2015-3749, CVE-2015-3752, CVE-2015-5788, CVE-2015-5794, CVE-2015-5801, CVE-2015-5809, CVE-2015-5822, CVE-2015-5928
MD5 | bd9d769cef0feca2c7e0181ec45e72a0
Sophos UTM 525 Full Guard Cross Site Scripting
Posted Mar 1, 2016
Authored by Dr. Adrian Vollmer

Inserting an HTML 'script' tag into the URL of a web site protected by Sophos UTM 525 yields an error page which contains the 'script' tag unfiltered. Executing malicious JavaScript code in the victim's browser is therefore straightforward.

tags | exploit, web, javascript
MD5 | 38d07a3666a3520683a372ffcc9aacc9
Htcap Analysis Tool Beta 1.0
Posted Feb 26, 2016
Authored by Filippo Cavallarin

Htcap is a web application analysis tool for detecting communications between javascript and the server. It crawls the target application and maps ajax calls, dynamically inserted scripts, websockets calls, dynamically loaded resources and some interesting elements. The generated report is meant to be a good starting point for a manual web application security audit. Htcap is written in python and uses phantomjs to load pages injecting a probe that analyzes javascript behaviour. Once injected, the probe, overrides native javascript methods in order to intercept communications and DOM changes. It also simulates user interaction by firing all attached events and by filling html inputs.

Changes: Major code rewrite and many features were added.
tags | tool, web, javascript, sniffer, python
MD5 | 09bdd3514bd444e411a87140b8bd28c2
JavaScript Anywhere 3.0.4 Script Insertion
Posted Feb 9, 2016
Authored by Benjamin Kunz Mejri | Site vulnerability-lab.com

JavaScript Anywhere version 3.0.4 suffers from a persistent script insertion vulnerability.

tags | exploit, javascript
MD5 | 8bf1a60fd95ebfdd037d1f8d7904a457
Samsung SecEmailUI Script Injection
Posted Feb 7, 2016
Authored by Google Security Research, forshaw

The default Samsung email client's email viewer and composer (implemented in SecEmailUI.apk) doesn't sanitize HTML email content for scripts before rendering the data inside a WebView. This allows an attacker to execute arbitrary JavaScript when a user views a HTML email which contains HTML script tags or other events.

tags | exploit, arbitrary, javascript
systems | linux
advisories | CVE-2015-7893
MD5 | 8a47c6ddd80bdce6d9af835b275d4ed2
Page 2 of 26
Back12345Next

File Archive:

October 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    15 Files
  • 2
    Oct 2nd
    16 Files
  • 3
    Oct 3rd
    15 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    11 Files
  • 6
    Oct 6th
    6 Files
  • 7
    Oct 7th
    2 Files
  • 8
    Oct 8th
    1 Files
  • 9
    Oct 9th
    13 Files
  • 10
    Oct 10th
    16 Files
  • 11
    Oct 11th
    15 Files
  • 12
    Oct 12th
    23 Files
  • 13
    Oct 13th
    13 Files
  • 14
    Oct 14th
    12 Files
  • 15
    Oct 15th
    2 Files
  • 16
    Oct 16th
    16 Files
  • 17
    Oct 17th
    16 Files
  • 18
    Oct 18th
    14 Files
  • 19
    Oct 19th
    8 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close