876 matches found
CVE-2019-11723
A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across different "containers" for people who use the Firefox Multi-Account Containers Web Extension. This...
Design/Logic Flaw
A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across different "containers" for people who use the Firefox Multi-Account Containers Web Extension. This...
CVE-2019-11723
A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across different "containers" for people who use the Firefox Multi-Account Containers Web Extension. This...
CVE-2019-11723
A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across different "containers" for people who use the Firefox Multi-Account Containers Web Extension. This...
Extract add-on for Nextcloud OS Command Injection Vulnerability
Extract add-on for Nextcloud is a set of component applications for Netcloud. An input validation vulnerability exists in Extract add-on for Nextcloud lib/Controller/ExtractionController.php, which allows remote attackers to submit a special request that can be used to execute arbitrary OS comman...
CVE-2019-12739
lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution via shell metacharacters in a RAR filename via ajax/extractRar.php nameOfFile and directory parameters...
CVE-2019-12739
lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution via shell metacharacters in a RAR filename via ajax/extractRar.php nameOfFile and directory parameters...
A week in security (May 6 – 12)
Last week on Labs, we discussed what to do when you discover a data breach, how 5G could impact cybersecurity strategy, the top six takeaways for user privacy, vulnerabilities in financial mobile apps that put consumers and businesses at risk, and in our series about vital infrastructure, we...
Path traversal
Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress when the Uploads add-on is activated. This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php aka upload/submit page name and...
Tor Security Add-On Abruptly Killed by Mozilla Bug
Thanks to Mozilla letting an intermediate signing certificate expire, the Tor community was thrown into disarray over the weekend when the NoScript security add-on was suddenly killed for both Firefox and the Tor browser. A fix is available for Firefox, but the Tor issue continues. NoScript is a...
Man-in-the-Middle
Mozilla Firefox, Firefox ESR and Thunderbird are vulnerable to man-in-the-middle attacks. A remote attacker can spoof add-on updates and obtain confidential information via leveraging possession of X.509 server certificates...
[SECURITY] Fedora 29 Update: jackson-module-jsonSchema-2.9.8-1.fc29
Add-on module for to support JSON Schema version 3 generation...
Cross site scripting
An issue was discovered in the Cross Reference Add-on 36 for Google Docs. Stored XSS in the preview boxes in the configuration panel may allow a malicious user to use both label text and references text to inject arbitrary JavaScript code via SCRIPT elements, event handlers, etc.. Since this code...
CVE-2019-7250
An issue was discovered in the Cross Reference Add-on 36 for Google Docs. Stored XSS in the preview boxes in the configuration panel may allow a malicious user to use both label text and references text to inject arbitrary JavaScript code via SCRIPT elements, event handlers, etc.. Since this code...
CVE-2019-7250
An issue was discovered in the Cross Reference Add-on 36 for Google Docs. Stored XSS in the preview boxes in the configuration panel may allow a malicious user to use both label text and references text to inject arbitrary JavaScript code via SCRIPT elements, event handlers, etc.. Since this code...
CVE-2019-7250
The CVE-2019-7250 issue affects the Cross Reference Add-on 36 for Google Docs. The vulnerability is a Stored XSS flaw in the plugin’s configuration panel preview boxes, where crafted label and references text can inject JavaScript code (via SCRIPT elements, event handlers, etc.). The stored paylo...
Cross-site Scripting (XSS)
firefox is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect contex...
Microsoft Office: Add-on Management
This test checks the setting for policy OpenVAS Vulnerability Test $Id: officeaddonmanagement.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Add-on Management Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is free software...
[SECURITY] Fedora 28 Update: mozilla-privacy-badger-2018.8.1-1.fc28
Privacy Badger is a browser add-on that stops advertisers and other third-p arty trackers from secretly tracking where you go and what pages you look at on the web. If an advertiser seems to be tracking you across multiple websites wit hout your permission, Privacy Badger automatically blocks tha...
[SECURITY] Fedora 27 Update: mozilla-privacy-badger-2018.8.1-1.fc27
Privacy Badger is a browser add-on that stops advertisers and other third-p arty trackers from secretly tracking where you go and what pages you look at on the web. If an advertiser seems to be tracking you across multiple websites wit hout your permission, Privacy Badger automatically blocks tha...