KLA12236 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, cause denial of service, spoof user interface, obtain sensitive information, perform cross-site scripting attack. Below is a complete li...

PT-2021-3679

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 92.0.4515.107 Description The issue is related to insufficient validation of user-input data in the Downloads directory, allowing a remote attacker to conduct domain spoofing attacks using a specially...

Microsoft SharePoint Missing Check of Message Integrity Vulnerability

This vulnerability allows network-adjacent attackers to tamper with update data on affected installations of Microsoft SharePoint. User interaction is required to exploit this vulnerability. The specific flaw exists within the handling of SharePoint Help updates. The issue results from a missing...

pikachu

It is an offensive tool for web application security training. The primary CVE ID is not explicitly mentioned, but the tool is designed to simulate various web application vulnerabilities, including Burt Force 暴力破解漏洞, XSS 跨站脚本漏洞, CSRF 跨站请求伪造, SQL-Inject SQL注入漏洞, RCE 远程命令/代码执行, Files Inclusion...

CVE-2021-32679

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, filenames where not escaped by default in controllers using DownloadResponse. When a user-supplied filename was passed unsanitized into a DownloadResponse, this could be used to...

CVE-2021-32679

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, filenames where not escaped by default in controllers using "DownloadResponse". When a user-supplied filename was passed unsanitized into a "DownloadResponse", this could be used ...

[SECURITY] Fedora 33 Update: djvulibre-3.5.27-28.fc33

DjVu is a web-centric format and software platform for distributing documents and images. DjVu can advantageously replace PDF, PS, TIFF, JPEG, and GIF for distributing scanned documents, digital documents, or high-resolution picture s. DjVu content downloads faster, displays and renders faster,...

Backdoor.Win32.Hupigon.gsy Unauthenticated Open Proxy

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/7e99aa748b61fd0802fa19cf9e4cf1f8.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Hupigon.gsy Vulnerability: Unauthenticated Open Proxy Description: The malware listen...

CVE-2021-29958

When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to private mode cookies being shared in normal browsing mode. This vulnerability affects Firefox for iOS 34...

CVE-2021-29958

When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to private mode cookies being shared in normal browsing mode. This vulnerability affects Firefox for iOS 34...

The vulnerability of the Admidio membership management and access control application lies in its ability to download files of a dangerous type without limitation, allowing a perpetrator to execute arbitrary code.

The vulnerability of the Admidio membership management and access control application lies in the ability to download unlimited files of a dangerous type. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary code using specially created .phar files...

Polazert Trojan using poisoned Google Search results to spread

Trojan.Polazert aka SolarMarker has gone back and fine-tuned an old tactic known as SEO-poisoning to plant their Remote Access Trojan RAT on as many systems as possible. This RAT runs in memory and is used by attackers to install additional malware on affected systems. Trojan.Polazert...

How to remove the File Transfer Tab in a Full VPN NetScaler Gateway

How to remove the "File Transfer" Tab to prevent users from downloading files when accessing the environment through the NetScaler Gateway...

The vulnerability of the module for creating and editing user-form templates of the “LOCMAN Designer Form” in the LOCMAN Product Lifecycle Management system lies in its ability to download files of a dangerous type indefinitely, allowing a perpetrator to execute arbitrary code.

The vulnerability of the module responsible for creating and editing user-form templates in the “LOZMAN Designer Form” component of the LOZMAN Product Lifecycle Management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability could allow an attacker to execu...

Google Chrome to Help Users Identify Untrusted Extensions Before Installation

Google on Thursday said it's rolling out new security features to Chrome browser aimed at detecting suspicious downloads and extensions via its Enhanced Safe Browsing feature, which it launched a year ago. To this end, the search giant said it will now offer additional protections when users...

Google PPC Ads Used to Deliver Infostealers

Researchers have tracked down the origins of several increasingly prevalent info-stealers – including Redline, Taurus, Tesla and Amadey – that threat actors are delivering via pay-per-click PPC ads in Google’s search results. On Wednesday, breach prevention firm Morphisec posted an advisory in...

github firefox-ios 信息泄露漏洞

github firefox-ios is a github open source application. Firefox for iOS is provided. An information disclosure vulnerability exists in github firefox-ios, which stems from the application outputting too much data during private browsing. When a client initiates a download, it does not check wheth...

PT-2021-16927 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.9.26 Description: A missing token check causes a CSRF issue in data download endpoints in com banners and com sysinfo. This allows for potential exploitation. Recommendations: For Joomla! versions 3.0.0 throug...

InvoicePlane Path Traversal Vulnerability

InvoicePlane is a software application. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. InvoicePlane version 1.5.11 suffers from a path traversal vulnerability that originates from a misconfigured web server that allows unauthenticated...

Opennms Group OpenNMS 跨站脚本漏洞

Opennms Group OpenNMS is an open source, enterprise-grade network monitoring and network management platform from the US-based OpenNMS Group Opennms Group. A cross-site scripting vulnerability exists in OpenNMS Horizon, which can be exploited by an attacker to inject arbitrary scripts and trick...