PT-2020-14723

Name of the Vulnerable Software and Affected Versions Joplin desktop versions 1.0.190 through 1.0.245 Description The issue allows for arbitrary code execution via a malicious HTML embed tag. This is an XSS issue that affects Joplin desktop, enabling potential attackers to execute arbitrary code...

CVE-2020-15930: Improper Neutralization of Input During Web Page Generation

An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag...

openSUSE Security Update : php7 (openSUSE-2020-1356)

This update for php7 fixes the following issues : - CVE-2020-7068: Use of freed hash key in the pharparsezipfile function bsc1175223. This update was imported from the SUSE:SLE-15-SP2:Update update project. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin we...

PT-2020-21540

Name of the Vulnerable Software and Affected Versions lazysizes versions prior to 5.2.1-rc1 Description The issue affects the video-embed plugin of lazysizes, which fails to properly sanitize certain attributes, including data-vimeo, data-vimeoparams, data-youtube, and data-ytparams. This oversig...

Phishing Attacks

firefox is vulnerable to phishing attacks. The vulnerability exists through a X-Frame-Options bypass using object or embed tags...

Mozilla: X-Frame-Options bypass using object or embed tags

Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird 78 and Firefox 78.0.2...

Mozilla: X-Frame-Options bypass using object or embed tags

Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird 78 and Firefox 78.0.2...

Mozilla: X-Frame-Options bypass using object or embed tags

Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird 78 and Firefox 78.0.2...

CVE-2020-15648

Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird 78 and Firefox 78.0.2...

CVE-2020-15648

Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird 78 and Firefox 78.0.2...

CVE-2020-15648

Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird 78 and Firefox 78.0.2...

Spoofing

Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird 78 and Firefox 78.0.2...

CVE-2020-15648

Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird 78 and Firefox 78.0.2...

PT-2020-21613

Name of the Vulnerable Software and Affected Versions Mozilla Firefox version 78.0.2 Firefox Extended Support Release 78.0.2esr ESR Description The issue involves an X-Frame-Options bypass using object or embed tags. This allows for potential security risks. No information is provided about the...

PT-2020-21612

Name of the Vulnerable Software and Affected Versions Mozilla Firefox version 78.0.2 Firefox Extended Support Release 78.0.2esr ESR Description The issue involves an X-Frame-Options bypass using object or embed tags. This could potentially allow malicious actors to bypass security restrictions...

PT-2020-22733

Name of the Vulnerable Software and Affected Versions Mozilla Firefox version 78.0.2 Firefox Extended Support Release 78.0.2esr ESR Description The issue involves an X-Frame-Options bypass using object or embed tags. This allows for potential security risks. There is no information provided about...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +3409 more potentially affected by CVE-2020-13935 via org.apache.tomcat.embed:tomcat-embed-websocket (>=8.5.4, <=8.5.56)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =8.5.4, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =10 - be.ordina:microservices-dashboard-server 1.0.1 and more Source cves: CVE-2020-13935 Source...

ch.rasc:embeddedtc (>=1.13, <=1.29), ch.rasc:embeddedtc-maven-plugin (>=1.11, <=1.23) +63 more potentially affected by CVE-2020-13935 via org.apache.tomcat.embed:tomcat-embed-websocket (>=7.0.52, <=7.0.94)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =7.0.52, =1.13, =1.11, =2.0.19, =0.15.0, =1.0.0, =1.0.0, =1.0.8, =0.3.0, =0.4.0, =0.2.0, =0.1.0, =0.3.0 and more Source cves: CVE-2020-13935 Source advisory: MEND:CVE-2020-13935...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.dstack:server-base-local (>=0.0.12, <=0.1.15) +4354 more potentially affected by CVE-2020-13935 via org.apache.tomcat.embed:tomcat-embed-websocket (>=9.0.0.m18, <=9.0.36)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =9.0.0.m18, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =j8.2.2.0, =greenwich.sr1, =greenwich.sr2, =greenwich.sr1, =greenwich.sr1, =greenwich.sr2, =greenwich.sr2.1 and more Source cves: CVE-2020-13935...

nz.net.osnz.composite:composite-spring-boot-tomcat (5.22) potentially affected by CVE-2020-13935 via org.apache.tomcat.embed:tomcat-embed-websocket (10.0.0-m4)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version 10.0.0-m4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-websocket and may be impacted: - nz.net.osnz.composite:composite-spring-boot-tomcat 5.22 Source...