CVE-2023-1720

Affected software: Bitrix24 22.0.300. Root cause: missing mime type response header. Vulnerability: allows authenticated remote attackers to upload a crafted HTML file via /desktop_app/file.ajax.php?action=uploadfile, enabling arbitrary JavaScript in the victim’s browser and, if the victim is an ...

Mozilla Firefox Cross-Site Scripting Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox. An attacker exploited the vulnerability to perform cross-site scripting attacks...

hopewelltwp.com Cross Site Scripting vulnerability OBB-3764501

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

React Developer Tools extension Improper Authorization vulnerability

The React Developer Tools extension registers a message listener with window.addEventListener'message', in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch. The URL is not...

CVE-2023-45280

Yamcs 5.8.6 allows XSS issue 2 of 2. It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload an HTML file containing arbitrary JavaScript and then navigate to it. Once the user opens the file, the browser will execute the arbitrar...

How to Guard Your Data from Exposure in ChatGPT

ChatGPT has transformed the way businesses generate textual content, which can potentially result in a quantum leap in productivity. However, Generative AI innovation also introduces a new dimension of data exposure risk, when employees inadvertently type or paste sensitive business data into...

CVE-2023-43729

Os Commerce is currently susceptible to a Cross-Site Scripting XSS vulnerability. This vulnerability allows attackers to inject JS through the "xselltypename1" parameter, potentially leading to unauthorized execution of scripts within a user's web browser...

CVE-2023-43724

Os Commerce is affected by a Cross-Site Scripting (XSS) vulnerability (CVE-2023-43724) that is described as a reflected XSS. The vulnerability stems from unsanitized input, allowing an attacker to inject JavaScript via the parameter derb6zmklgtjuhh2cn5chn2qjbm2stgmfa4.oastify.comscription[1][name...

PT-2023-28922 · Unknown · Oscommerce

Name of the Vulnerable Software and Affected Versions: Os Commerce affected versions not specified Description: The issue is a Cross-Site Scripting XSS vulnerability that allows attackers to inject JavaScript through the title parameter. This potentially leads to unauthorized execution of scripts...

The Dark Side of Browser Isolation – and the Next Generation Browser Security Technologies

The landscape of browser security has undergone significant changes over the past decade. While Browser Isolation was once considered the gold standard for protecting against browser exploits and malware downloads, it has become increasingly inadequate and insecure in today's SaaS-centric world...

Researchers Uncover New GPU Side-Channel Vulnerability Leaking Sensitive Data

A novel side-channel attack called GPU.zip renders virtually all modern graphics processing units GPU vulnerable to information leakage. "This channel exploits an optimization that is data dependent, software transparent, and present in nearly all modern GPUs: graphical data compression," a group...

salsaaixchange.de Cross Site Scripting vulnerability OBB-3635903

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-4296

PTC Codebeamer CVE-2023-4296 is a cross-site scripting vulnerability (CWE-79) in the Codebeamer ALM platform. An attacker tricks an admin into clicking a malicious link, potentially injecting arbitrary JavaScript into the victim’s browser. Affected versions: Codebeamer <= 22.10-SP7, <= 22.0...

CVE-2020-11711

An issue was discovered in Stormshield SNS 3.8.0. Authenticated Stored XSS in the admin login panel leads to SSL VPN credential theft. A malicious disclaimer file can be uploaded from the admin panel. The resulting file is rendered on the authentication interface of the admin panel. It is possibl...

Guide: How Google Workspace-based Organizations can leverage Chrome to improve Security

More and more organizations are choosing Google Workspace as their default employee toolset of choice. But despite the productivity advantages, this organizational action also incurs a new security debt. Security teams now have to find a way to adjust their security architecture to this new cloud...

COURIER DEPRIXA 2.5 Cross Site Request Forgery

==================================================================================================================================== | Title : COURIER DEPRIXA V2.5 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 102.0.164-bit | |...

RFP Template for Browser Security

Increasing cyber threats and attacks have made protecting organizational data a paramount concern for businesses of all sizes. A group of experts have recognized the pressing need for comprehensive browser security solutions and collaborated to develop "The Definitive Browser Security RFP...

USN-6264-1: WebKitGTK vulnerabilities

Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and...

IBM Cognos Analytics Multiple Vulnerabilities (7012621)

The version of IBM Cognos Analytics installed on the remote host is 11.1.x prior to 11.1.7 Fix Pack 7 or 11.2.x prior to 11.2.4 FP2. It is, therefore, affected by multiple vulnerabilities, including the following: - netplex json-smart-v2 is vulnerable to a denial of service, caused by not limitin...

Apple Safari 安全漏洞

Apple Safari is a web browser from Apple Inc. and is the default browser that comes with the Mac OS X and iOS operating systems. A security vulnerability exists in Apple Safari versions prior to 16.6. An attacker can exploit the vulnerability to execute arbitrary code...