Twenty Year Anniversary
Showing 101 - 125 of 656 RSS Feed

JavaScript Files

Red Hat Security Advisory 2014-1744-01
Posted Oct 30, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1744-01 - V8 is Google's open source JavaScript engine. It was discovered that V8 did not properly check the stack size limit in certain cases. A remote attacker able to send a request that caused a script executed by V8 to use deep recursion could trigger a stack overflow, leading to a crash of an application using V8. Multiple flaws were discovered in V8. Untrusted JavaScript code executed by V8 could use either of these flaws to crash V8 or, possibly, execute arbitrary code with the privileges of the user running V8.

tags | advisory, remote, overflow, arbitrary, javascript
systems | linux, redhat
advisories | CVE-2013-6639, CVE-2013-6640, CVE-2013-6650, CVE-2013-6668, CVE-2014-1704, CVE-2014-5256
MD5 | f1af5e450e6fdc8f338c2df352090022
Mandriva Linux Security Advisory 2014-206
Posted Oct 24, 2014
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2014-206 - A denial of service issue was discovered in ctags 5.8. A remote attacker could cause excessive CPU usage and disk space consumption via a crafted JavaScript file by triggering an infinite loop.

tags | advisory, remote, denial of service, javascript
systems | linux, mandriva
advisories | CVE-2014-7204
MD5 | 2f6a84215d9ff0054e968de79614060b
Mandriva Linux Security Advisory 2014-198
Posted Oct 21, 2014
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2014-198 - MediaWiki before 1.23.4 is vulnerable to cross-site scripting due to JavaScript injection via CSS in uploaded SVG files. MediaWiki before 1.23.5 is vulnerable to cross-site scripting due to JavaScript injection via user-specificed CSS in certain special pages.

tags | advisory, javascript, xss
systems | linux, mandriva
advisories | CVE-2014-7199, CVE-2014-7295
MD5 | d2e374028142e4024b2a82786253e5cf
Red Hat Security Advisory 2014-1647-01
Posted Oct 15, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1647-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed.

tags | advisory, remote, web, arbitrary, javascript
systems | linux, redhat
advisories | CVE-2014-1574, CVE-2014-1577, CVE-2014-1578, CVE-2014-1581
MD5 | c24c5964a0ae870d38ad24408749517f
Debian Security Advisory 3046-1
Posted Oct 6, 2014
Authored by Debian | Site debian.org

Debian Linux Security Advisory 3046-1 - It was reported that MediaWiki, a website engine for collaborative work, allowed to load user-created CSS on pages where user-created JavaScript is not allowed. A wiki user could be tricked into performing actions by manipulating the interface from CSS, or JavaScript code being executed from CSS, on security-wise sensitive pages like Special:Preferences and Special:UserLogin. This update removes the separation of CSS and JavaScript module allowance.

tags | advisory, javascript
systems | linux, debian
advisories | CVE-2014-7295
MD5 | f7589dc4e9d2f3e241f5d7c3deb5e578
ZyXEL SBG-3300 Security Gateway Denial Of Service
Posted Oct 3, 2014
Authored by Mirko Casadei

ZyXEL SBG-3300 Security Gateway suffers from a malicious javascript denial of service vulnerability.

tags | exploit, denial of service, javascript
advisories | CVE-2014-7278
MD5 | 282b257bf5b5859ca0c24098bf1f14ef
Apple Security Advisory 2014-09-17-5
Posted Sep 19, 2014
Authored by Apple | Site apple.com

Apple Security Advisory 2014-09-17-5 - OS X Server 3.2.1 is now available and addresses arbitrary SQL execution, arbitrary javascript execution, and multiple vulnerabilities in PostgreSQL.

tags | advisory, arbitrary, javascript
systems | apple, osx
advisories | CVE-2014-0060, CVE-2014-0061, CVE-2014-0062, CVE-2014-0063, CVE-2014-0064, CVE-2014-0065, CVE-2014-0066, CVE-2014-4406, CVE-2014-4424
MD5 | 46b96ce83e6920723049bf0de2dcb542
Firefox WebIDL Privileged Javascript Injection
Posted Aug 27, 2014
Authored by joev, Marius Mlynski | Site metasploit.com

This exploit gains remote code execution on Firefox 22-27 by abusing two separate privilege escalation vulnerabilities in Firefox's Javascript APIs.

tags | exploit, remote, javascript, vulnerability, code execution
advisories | CVE-2014-1510, CVE-2014-1511
MD5 | cd3bc27615aee1fe6d9023c93754e0ee
Firefox toString console.time Privileged Javascript Injection
Posted Aug 18, 2014
Authored by moz_bug_r_a4, joev, Cody Crews | Site metasploit.com

This Metasploit module gains remote code execution on Firefox 15-22 by abusing two separate Javascript-related vulnerabilities to ultimately inject malicious Javascript code into a context running with chrome:// privileges.

tags | exploit, remote, javascript, vulnerability, code execution
advisories | CVE-2013-1670, CVE-2013-1710
MD5 | 161163ea27bfe8bf6f13a8d33a2731a7
Apache Cordova 3.5.0 Data Leak
Posted Aug 12, 2014
Authored by Roee Hay, David Kaplan

Android applications built with the Cordova framework can launch other applications through the use of anchor tags, or by redirecting the webview to an Android intent URL. An attacker who can manipulate the HTML content of a Cordova application can create links which open other applications and send arbitrary data to those applications. An attacker who can run arbitrary JavaScript code within the context of the Cordova application can also set the document location to such a URL. By using this in concert with a second, vulnerable application, an attacker might be able to use this method to send data from the Cordova application to the network. This release is an update to a prior advisory.

tags | advisory, arbitrary, javascript
advisories | CVE-2014-3502
MD5 | 11bd1a4ff480650cd4d04188db43facf
Baidu Spark Browser 26.5.9999.3511 Stack Overflow
Posted Jun 30, 2014
Authored by LiquidWorm | Site zeroscience.mk

Spark Browser version 26.5.9999.3511 allows remote attackers to cause a denial of service (application crash) resulting in stack overflow via nested calls to the window.print javascript function.

tags | exploit, remote, denial of service, overflow, javascript
MD5 | 00d4cae32afc7dd800c0f99fa2089885
Sophos Antivirus 9.5.1 Cross Site Scripting
Posted Jun 26, 2014
Authored by Pablo Catalina | Site portcullis-security.com

The Configuration Console of Sophos Antivirus version 9.5.1 (Linux) does not sanitize several input parameters before sending them back to the browser, so an attacker could inject code inside these parameters, including JavaScript code.

tags | advisory, javascript, xss
systems | linux
advisories | CVE-2014-2385
MD5 | b50071d884e4bb8703c92578301ba5cb
Endeca Latitude 2.2.2 Cross Site Scripting
Posted Jun 25, 2014
Site redteam-pentesting.de

RedTeam Pentesting discovered a cross site scripting vulnerability in Endeca Latitude version 2.2.2. By exploiting this vulnerability an attacker is able to execute arbitrary JavaScript code in the context of other Endeca Latitude users.

tags | exploit, arbitrary, javascript, xss
advisories | CVE-2014-2400
MD5 | 8e9a895e532aebf33732d79e3c08ab34
Red Hat Security Advisory 2014-0785-01
Posted Jun 24, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0785-01 - Red Hat JBoss Web Framework Kit combines popular open source web frameworks into a single solution for Java applications. Seam is an open source development platform for building rich Internet applications in Java. Seam integrates technologies such as Asynchronous JavaScript and XML, JavaServer Faces, Java Persistence API, and Enterprise Java Beans. Seam 2.3 provides support for JSF 2, RichFaces 4, and JPA 2 capabilities, running on top of Red Hat JBoss Enterprise Application Platform 6. It was found that the org.jboss.seam.web.AuthenticationFilter class implementation did not properly use Seam logging. A remote attacker could send specially crafted authentication headers to an application, which could result in arbitrary code execution with the privileges of the user running that application.

tags | advisory, remote, web, arbitrary, javascript, code execution
systems | linux, redhat
advisories | CVE-2014-0248
MD5 | f5ef970fb9b706e2cdd8e4773250056e
Adobe Reader for Android addJavascriptInterface Exploit
Posted Jun 16, 2014
Authored by Yorick Koster, joev | Site metasploit.com

Adobe Reader versions less than 11.2.0 exposes insecure native interfaces to untrusted javascript in a PDF. This Metasploit module embeds the browser exploit from android/webview_addjavascriptinterface into a PDF to get a command shell on vulnerable versions of Reader.

tags | exploit, shell, javascript
advisories | CVE-2014-0514
MD5 | 7adbb95817e1fbb6dfec43a3d5132ee8
Debian Security Advisory 2957-1
Posted Jun 13, 2014
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2957-1 - Omer Iqbal discovered that Mediawiki, a wiki engine, parses invalid usernames on Special:PasswordReset as wikitext when $wgRawHtml is enabled. On such wikis this allows an unauthenticated attacker to insert malicious JavaScript, a cross site scripting attack.

tags | advisory, javascript, xss
systems | linux, debian
advisories | CVE-2014-3966
MD5 | 2dd7d131a5daf996d82f40652d80f908
Mandriva Linux Security Advisory 2014-111
Posted Jun 10, 2014
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2014-111 - A logged in attacker could insert special content in dynamic fields, leading to JavaScript code being executed in OTRS. An attacker could embed OTRS in a hidden iframe tag of another page, tricking the user into clicking links in OTRS.

tags | advisory, javascript
systems | linux, mandriva
advisories | CVE-2014-2553, CVE-2014-2554
MD5 | 6a5a63940f8655aad63e04cd335c6287
Adobe Reader For Android Javascript Insecure
Posted Apr 13, 2014
Authored by Yorick Koster

Adobe Reader for Android exposes several insecure Javascript interfaces. This issue can be exploited by opening a malicious PDF in Adobe Reader. Exploiting this issue allows for the execution of arbitrary Java code, which can result in a compromise of the documents stored in Reader and files stored on SD card.

tags | exploit, arbitrary, javascript
MD5 | 54833710fb3ca3fc5ad490ed04b81e8a
rexx Recruitment Cross Site Scripting
Posted Mar 27, 2014
Site redteam-pentesting.de

RedTeam Pentesting discovered a cross site scripting vulnerability in rexx Recruitment's user registration page during a penetration test. If attackers can persuade users to click on a prepared link or redirected them to such a link from an attacker-controlled website, they are able to run arbitrary JavaScript code in the context of the rexx Recruitment installation's domain.

tags | exploit, arbitrary, javascript, xss
advisories | CVE-2014-1224
MD5 | 97986366cde5127bc8b94ed55a77a95a
1XTRA Browser 1.0 Remote Code Execution
Posted Mar 18, 2014
Authored by Keith Makan

XTRA Browser suffers from a remote code execution vulnerability stemming from insecure use of the addJavascriptInterface functionality. The vulnerability allows attackers to execute code through targeted browsing attacks to pages hosting malicious JavaScript or by loading up a malicious file into the affected application from the local storage.

tags | advisory, remote, local, javascript, code execution
MD5 | 2906e8ed19c4fdac9dd8b1b4f2ae65c5
Mandriva Linux Security Advisory 2014-054
Posted Mar 13, 2014
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2014-054 - An attacker could send a specially prepared HTML email to OTRS. If he can then trick an agent into following a special link to display this email, JavaScript code would be executed.

tags | advisory, javascript
systems | linux, mandriva
advisories | CVE-2014-1695
MD5 | 883e7585cdbf880fb1bf60b0b1eb6713
Mandriva Linux Security Advisory 2014-057
Posted Mar 13, 2014
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2014-057 - MediaWiki user Michael M reported that the fix for CVE-2013-4568 allowed insertion of escaped CSS values which could pass the CSS validation checks, resulting in XSS. Chris from RationalWiki reported that SVG files could be uploaded that include external stylesheets, which could lead to XSS when an XSL was used to include JavaScript. During internal review, it was discovered that MediaWiki's SVG sanitization could be bypassed when the XML was considered invalid. During internal review, it was discovered that MediaWiki displayed some information about deleted pages in the log API, enhanced RecentChanges, and user watchlists. Netanel Rubin from Check Point discovered a remote code execution vulnerability in MediaWiki's thumbnail generation for DjVu files. Internal review also discovered similar logic in the PdfHandler extension, which could be exploited in a similar way. MediaWiki before 1.22.3 does not block unsafe namespaces, such as a W3C XHTML namespace, in uploaded SVG files. Some client software may use these namespaces in a way that results in XSS. This was fixed by disallowing uploading SVG files using non-whitelisted namespaces. MediaWiki before 1.22.3 performs token comparison that may be vulnerable to timing attacks. This was fixed by making token comparison use constant time. MediaWiki before 1.22.3 could allow an attacker to perform XSS attacks, due to flaw with link handling in api.php. This was fixed such that it won't find links in the middle of api.php links. MediaWiki has been updated to version 1.22.3, which fixes these issues, as well as several others. Also, the mediawiki-ldapauthentication and mediawiki-math extensions have been updated to newer versions that are compatible with MediaWiki 1.22. Additionally, the mediawiki-graphviz extension has been obsoleted, due to the fact that it is unmaintained upstream and is vulnerable to cross-site scripting attacks. Note: if you were using the instances feature in these packages to support multiple wiki instances, this feature has now been removed. You will need to maintain separate wiki instances manually.

tags | advisory, remote, php, javascript, code execution, xss
systems | linux, mandriva
advisories | CVE-2013-6451, CVE-2013-6452, CVE-2013-6453, CVE-2013-6472, CVE-2014-1610, CVE-2014-2242, CVE-2014-2243, CVE-2014-2244
MD5 | 45e737dcfa0c42c94baa431905ea05d2
Firefox Exec Shellcode From Privileged Javascript Shell
Posted Mar 13, 2014
Authored by joev | Site metasploit.com

This Metasploit module allows execution of native payloads from a privileged Firefox Javascript shell. It puts the specified payload into memory, adds the necessary protection flags, and calls it. Useful for upgrading a Firefox javascript shell to a Meterpreter session without touching the disk.

tags | exploit, shell, javascript
MD5 | d41a7beebd334541e6643cd39ede1caf
Open-Xchange 7.4.1 Script Insertion
Posted Feb 11, 2014
Authored by joernchen, Martin Braun

Open-Xchange AppSuite version 7.4.1 fails to properly neutralize javascript inserted at the header of an SVG image file.

tags | advisory, javascript
advisories | CVE-2014-1679
MD5 | bc21012775f1fb67c09ffbca640ce011
Android Browser / WebView addJavascriptInterface Code Execution
Posted Feb 7, 2014
Authored by jduck, joev | Site metasploit.com

This Metasploit module exploits a privilege escalation issue in Android versions prior 4.2's WebView component that arises when untrusted Javascript code is executed by a WebView that has one or more Interfaces added to it. The untrusted Javascript code can call into the Java Reflection APIs exposed by the Interface and execute arbitrary commands. Some distributions of the Android Browser app have an addJavascriptInterface call tacked on, and thus are vulnerable to RCE. The Browser app in the Google APIs 4.1.2 release of Android is known to be vulnerable. A secondary attack vector involves the WebViews embedded inside a large number of Android applications. Ad integrations are perhaps the worst offender here. If you can MITM the WebView's HTTP connection, or if you can get a persistent XSS into the page displayed in the WebView, then you can inject the html/js served by this module and get a shell. Note: Adding a .js to the URL will return plain javascript (no HTML markup).

tags | exploit, web, arbitrary, shell, javascript
MD5 | b1f0b039cf8acfc93ca30fa9147f1966
Page 5 of 27
Back34567Next

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

May 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    15 Files
  • 2
    May 2nd
    17 Files
  • 3
    May 3rd
    30 Files
  • 4
    May 4th
    29 Files
  • 5
    May 5th
    2 Files
  • 6
    May 6th
    3 Files
  • 7
    May 7th
    13 Files
  • 8
    May 8th
    27 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    15 Files
  • 11
    May 11th
    8 Files
  • 12
    May 12th
    2 Files
  • 13
    May 13th
    8 Files
  • 14
    May 14th
    7 Files
  • 15
    May 15th
    43 Files
  • 16
    May 16th
    19 Files
  • 17
    May 17th
    16 Files
  • 18
    May 18th
    15 Files
  • 19
    May 19th
    3 Files
  • 20
    May 20th
    7 Files
  • 21
    May 21st
    15 Files
  • 22
    May 22nd
    40 Files
  • 23
    May 23rd
    61 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close