CVE-2021-33594

An address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially crafted a malicious URL, it appears like a legitimate one on the address bar, while the content comes from other domain and presented in a window, covering the original content. A...

Spoofing

A address bar spoofing vulnerability was discovered in Safe Browser for iOS. Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit domain. A remote attacker can leverage this to perform address...

CVE-2021-33594 F-Secure Safe browser for Android vulnerable to Address Bar Spoofing

An address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially crafted a malicious URL, it appears like a legitimate one on the address bar, while the content comes from other domain and presented in a window, covering the original content. A...

CVE-2021-33594

CVE-2021-33594 documents an address bar spoofing vulnerability in Safe Browser for Android. The vulnerability allows a remote attacker to present a legitimate-looking URL in the address bar while loading content from a different domain in a window, effectively deceiving users. Reported consistent...

CVE-2021-33595 F-Secure Safe browser for iOS vulnerable to Address Bar Spoofing

A address bar spoofing vulnerability was discovered in Safe Browser for iOS. Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit domain. A remote attacker can leverage this to perform address...

CVE-2021-33595

Affected product. Safe Browser for iOS (F-Secure Safe Browser). Issue. Address bar spoofing: the address bar shows a legitimate URL while loading content from another domain, causing users to believe the content is from a trusted site. Root cause (as described). A mismatch between displayed URL a...

F-secure Safe 安全漏洞

F-secure F-Secure SAFE is a suite of antivirus software from the Finnish company F-Secure F-secure. A security vulnerability exists in F-secure Safe Browser that stems from a flaw in the product implementation. When a user clicks on a malicious link, the browser address bar displays a legitimate...

WPFront Notification Bar < 2.1.0.08087 - Authenticated Stored XSS

The plugin does not properly sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. To execute the XSS on all frontend pages and plugin's setting page, add the following payload in the...

WordPress WPFront Notification Bar plugin <= 2.1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Siddheshwar Vishwambhar Mane in WordPress WPFront Notification Bar plugin versions = 2.1.0. Solution Update the WordPress WPFront Notification Bar plugin to the latest available version at least 2.1.0.08087...

WordPress Border Loading Bar plugin <= 1.0.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by iohex and WPScanTeam in WordPress Border Loading Bar plugin versions = 1.0.1. Solution This plugin has been closed as of September 7, 2021 and is not available for download. This closure is temporary, pending a full review...

WordPress Woosaleskit Bar plugin <= 1.0.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by iohex and WPScanTeam in WordPress Woosaleskit Bar plugin versions = 1.0.0. Solution This plugin has been closed as of May 2, 2019 and is not available for download. Reason: Guideline Violation...

WPFront Notification Bar < 2.1.0.08087 - Authenticated Stored XSS

The plugin does not properly sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC To execute the XSS on all frontend pages and plugin's setting page, add the following payload in...

CVE-2021-33596

Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit domain. Exploiting the vulnerability requires the user to click on a specially crafted, seemingly legitimate URL containing an embedded...

CVE-2021-29975

Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or formatting, could be overlaid on top of another domain with the new domain correctly shown in the address bar resulting in possible user confusion. This vulnerability affects Firefox ...

CVE-2021-30587

Inappropriate implementation in Compositing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially spoof the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2021-24425

The Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu WordPress plugin before 2.5.2 does not sanitise or escape its Bar Text settings, allowing hight privilege users to use malicious JavaScript in it, leading to a Stored Cross-Site Scripting issue,...

CVE-2021-24425

The Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu WordPress plugin before 2.5.2 does not sanitise or escape its Bar Text settings, allowing hight privilege users to use malicious JavaScript in it, leading to a Stored Cross-Site Scripting issue,...

jenkins: XSS vulnerability in notification bar

A flaw was found in jenkins. A cross-site scripting XSS vulnerability is possible due to the contents of the notification bar responses not being properly escaped. The highest threat from this vulnerability is to data confidentiality and integrity...

The vulnerability of the Google Chrome browser’s URL component, related to security configuration errors, allows attackers to compromise data integrity.

The vulnerability of the Google Chrome browser’s URL component is related to insufficient data validation during formatting. Exploiting this vulnerability can allow an attacker to compromise the integrity of data...

WordPress WPFront Notification Bar plugin <= 1.9.2 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered in WordPress WPFront Notification Bar plugin versions = 1.9.2. Solution Update the WordPress WPFront Notification Bar plugin to the latest available version at least 2.0.0...