SUSE CVE-2018-5134

WebExtensions may use "view-source:" URLs to view local "file:" URL content, as well as content stored in "about:cache", bypassing restrictions that only allow WebExtensions to view specific content. This vulnerability affects Firefox 59...

SUSE CVE-2018-18495

WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions...

SUSE CVE-2020-15664

By holding a reference to the eval function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious...

SUSE CVE-2021-23985

If an attacker is able to alter specific about:config values for example malware running on the user's computer, the Devtools remote debugging feature could have been enabled in a way that was unnoticable to the user. This would have allowed a remote attacker able to make a direct network...

SUSE CVE-2021-45085

XSS can occur in GNOME Web aka Epiphany before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a user visits an XSS payload page often enough to place that page on the Most Visited list...

soybase.org Cross Site Scripting vulnerability OBB-3177433

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

gatchfanfic.com Cross Site Scripting vulnerability OBB-3144399

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-34322: Improper Neutralization of Input During Web Page Generation

Multiple XSS issues were discovered in Sage Enterprise Intelligence 2021 R1.1 that allow an attacker to execute JavaScript code in the context of users' browsers. The attacker needs to be authenticated to reach the vulnerable features. An issue is present in the Notify Users About Modification me...

omnia-raczynscy.pl Cross Site Scripting vulnerability OBB-3071621

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The vulnerability of Mozilla Firefox, Mozilla Firefox ESR, and the email client Thunderbird arises from the improper use of privileged APIs, allowing an attacker to install extensions.

The vulnerability in Mozilla Firefox, Mozilla Firefox ESR, and the email client Thunderbird is related to the improper use of privileged APIs. Exploiting this vulnerability allows a malicious actor to install extensions by capturing the link to the eval function from the about:blank window, there...

CVE-2022-36387

Broken Access Control vulnerability in Alessio Caiazza's About Me plugin = 1.0.12 at WordPress...

CVE-2022-36387

Broken Access Control vulnerability in Alessio Caiazza's About Me plugin = 1.0.12 at WordPress...

CVE-2022-36427

Missing Access Control vulnerability in About Rentals. Inc. About Rentals plugin = 1.5 at WordPress...

CVE-2022-36427

Missing Access Control vulnerability in About Rentals. Inc. About Rentals plugin = 1.5 at WordPress...

Improper access control

Broken Access Control vulnerability in Alessio Caiazza's About Me plugin = 1.0.12 at WordPress...

Improper access control

Missing Access Control vulnerability in About Rentals. Inc. About Rentals plugin = 1.5 at WordPress...

CVE-2022-36427

The CVE-2022-36427 entry concerns the WordPress About Rentals plugin (versions

CVE-2022-36427 WordPress About Rentals plugin <= 1.5 - Missing Access Control vulnerability

Missing Access Control vulnerability in About Rentals. Inc. About Rentals plugin = 1.5 at WordPress...

CVE-2022-36387 WordPress About Me plugin <= 1.0.12 - Broken Access Control vulnerability

Broken Access Control vulnerability in Alessio Caiazza's About Me plugin = 1.0.12 at WordPress...

CVE-2022-36387

CVE-2022-36387 affects the WordPress plugin About Me (versions ≤ 1.0.12). The issue is described as a Broken Access Control vulnerability, enabling an authenticated user (e.g., a Subscriber) to perform unsafe actions via AJAX, including arbitrary network creation/deletion . This stems from insuff...