Malicious Package

Overview active-supportaliasclassmethod is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid...

Malicious Package

Overview a1409yo-health is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using a1409yo-heal...

Certain HTTPS sites cannot be opened in Firefox after you install update 2965142 in Windows 8.1 or Windows RT 8.1

Certain HTTPS sites cannot be opened in Firefox after you install update 2965142 in Windows 8.1 or Windows RT 8.1 This article describes an update for Microsoft Family Safety. Prior to installing this update, Windows Update will verify that mandatory update 2919355 has been installed on your...

cekmeceet.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1130490 Security Researcher geeknik Helped patch 8696 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting cekmeceet.com website and...

Security update for Windows 10, version 1607, 1703, 1709, 1803, 1809, 1903, 1909, Windows Server 2016 and Windows Server 2019: February 11, 2020

None None...

CVE-2019-11747

The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site. This includes removing any HTTP Strict Transport Security HSTS settings received from sites that use it. Due to a bug, sites on the pre-load list also have...

CVE-2019-11747

CVE-2019-11747 affects Mozilla Firefox and Firefox ESR. The vulnerability stems from a bug in the History pane’s “Forget about this site” feature which, while intended to delete site-visit data, also removes HSTS settings for sites on the pre-load list. As a result, on the next visit, if a user u...

UBUNTU-CVE-2019-11747

The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site. This includes removing any HTTP Strict Transport Security HSTS settings received from sites that use it. Due to a bug, sites on the pre-load list also have...

WordPress i-recommend-this plugin SQL injection vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. i-recommend-this is a plugin used in it for liking and voting on a page. A SQL injection vulnerability exists in the WordPress...

Sql injection

The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection...

CVE-2014-10376

CVE-2014-10376 affects the WordPress plugin i-recommend-this (before version 3.7.3). The vulnerability is a SQL injection in the plugin, allowing potential arbitrary SQL execution with network access and no authentication. CVSS: 3.0 base score 9.8 (CRITICAL) across confidentiality, integrity, and...

CVE-2014-10376: Improper Neutralization of Special Elements used in an SQL Command

The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection...

bangkok.immigration.go.th Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-928873 Security Researcher KhanJanny Helped patch 3055 vulnerabilities Received 9 Coordinated Disclosure badges Received 38 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting bangkok.immigration.go.th...

Mozilla’s ‘Track This’ lets you choose fake identity to deceive advertisers

By Waqas Track This is a new kind of incognito, says Mozilla. It is a fact that everything that you do on the Internet such as using Facebook or Twitter, online shopping or aimlessly surfing the web, is being tracked. Haven’t you noticed that as soon as you search for something, ads relevant to t...

Share This Image <= 1.19 - Stored XSS

Stored XSS occurs when a web application gathers input from a user which might be malicious, and then stores that input in a data store for later use. The input that is stored is not correctly filtered Go to the Share This Image menu, and put " in the Selector field from the "What to Share" secti...

Share This Image <= 1.19 - Stored XSS

Stored XSS occurs when a web application gathers input from a user which might be malicious, and then stores that input in a data store for later use. The input that is stored is not correctly filtered PoC Go to the Share This Image menu, and put " in the Selector field from the "What to Share"...

Google Chrome < M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free

There's a race-condition / object-lifetime issue in the browser process when the browser process shutdown races against the IO thread handling mojo messages from the renderer. It's at least possible to trigger this by closing the browser while running the attached poc; I'm not sure if there's a...

Rockstar Games: Race condition vulnerability on "This Rocks" button.

In this report, the researcher brought to our attention a misbehavior in the "This Rocks" button that we use on the Social Club site. Using curl and a proxy tool such as Burp Suite, an attacker could invoke the "This Rocks" API call multiple times rapidly, and the system would accept multiple...

WordPress 4.2.x < 4.2.13 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability exists in the wpplaylistshortcode function within the /wp-includes/media.php script due to a failure to validate input passed via...

WordPress 4.4.x < 4.4.8 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability exists in the wpplaylistshortcode function within the /wp-includes/media.php script due to a failure to validate input passed via...