WordPress Hide Admin Bar Based on User Roles plugin <= 3.0.0 - Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by Jan w Oleju in WordPress Hide Admin Bar Based on User Roles plugin versions = 3.0.0. Solution Update the WordPress Hide Admin Bar Based on User Roles plugin to the latest available version at least 3.1.0...

Hide Admin Bar Based on User Roles < 3.0.0 - Subscriber+ Settings Update

The plugin does not have authorisation and CSRF checks, allowing any authenticated users, such as subscriber, to update the plugin's settings https://example.com/wp-admin/admin-ajax.php?action=saveuserroles&caps=test&disableForAll=no...

WordPress Hide Admin Bar Based on User Roles plugin <= 2.9.0 - Subscriber+ Settings Update vulnerability

Subscriber+ Settings Update vulnerability discovered by Jan w Oleju in WordPress Hide Admin Bar Based on User Roles plugin versions = 2.9.0. Solution Update the WordPress Hide Admin Bar Based on User Roles plugin to the latest available version at least 3.0.0...

GLSA-202202-02 : Chromium, Google Chrome: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202202-02 Chromium, Google Chrome: Multiple vulnerabilities - Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

orderonline.bigbenpizzabar.com.au Cross Site Scripting vulnerability OBB-2374651

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-0110

Incorrect security UI in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2022-0118

The CVE-2022-0118 issue affects Google Chrome/Chromium’s WebShare implementation. A bug allowed a remote attacker to potentially hide the Omnibox contents via a crafted HTML page. Public materials trace the vulnerability to WebShare behavior and indicate fixes were shipped in Chrome/Chromium arou...

CVE-2022-0116

CVE-2022-0116 affects Google Chrome/Chromium. Root cause: inappropriate implementation in Compositing. Impact: remote attacker can spoof the Omnibox (URL bar) via a crafted HTML page. Affected: Chrome/Chromium builds prior to 97.0.4692.71. Mitigation: upgrade to 97.0.4692.71 or newer (per linked ...

CVE-2022-0110

CVE-2022-0110 affects Google Chrome/Chromium Autofill in the Omnibox where an incorrect security UI could be spoofed by a crafted HTML page. The issue is observed in Chrome prior to 97.0.4692.71; Debian notes a fix in 97.0.4692.71-0.1~deb11u1 for bullseye, while Gentoo references Chromium/Chrome ...

Google Chrome Input Validation Error Vulnerability (CNVD-2022-45564)

Google Chrome is a web browser from Google, Inc. An input validation error vulnerability exists in Google Chrome, which could be exploited by remote attackers to spoof the contents of the multi-function box URL bar via a crafted HTML page...

AlmaLinux 8 : GNOME (ALSA-2019:3553)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2019:3553 advisory. - It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical...

Google Chrome 输入验证错误漏洞

Google Chrome is a web browser from Google, Inc. An input validation error vulnerability exists in Google Chrome, which could be exploited by remote attackers to spoof the contents of the multi-function box URL bar via a crafted HTML page...

Mageia: Security Advisory (MGASA-2013-0383)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Hackers Attempt to Exploit New SolarWinds Serv-U Bug in Log4Shell Attacks

Microsoft on Wednesday disclosed details of a new security vulnerability in SolarWinds Serv-U software that it said was being weaponized by threat actors to propagate attacks leveraging the Log4j flaws to compromise targets. Tracked as CVE-2021-35247 CVSS score: 5.3, the issue is an "input...

CVE-2021-39628

In StatusBar.java, there is a possible disclosure of notification content on the lockscreen due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2021-39628

In StatusBar.java, there is a possible disclosure of notification content on the lockscreen due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

The vulnerability of Google Chrome’s compositing component allows a hacker to manipulate the URL bar’s content using a specially created HTML page.

The vulnerability of Google Chrome’s compositing component is related to a lack of mechanisms for verifying the source of the content. Exploiting this vulnerability could allow an attacker to manipulate the URL input by using a specially created HTML page...

CVE-2021-38020

Insufficient policy enforcement in contacts picker in Google Chrome on Android prior to 96.0.4664.45 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2021-38020

Insufficient policy enforcement in contacts picker in Google Chrome on Android prior to 96.0.4664.45 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2021-24941

The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.0.5 does not sanitise and escape the messageid parameter of the getmessageactionrow AJAX action before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue...