Naver Whale Browser Security Vulnerability

Naver Whale Browser is a web browser from South Korea's Naver that supports user-defined interfaces. A security vulnerability exists in Naver Whale Browser versions prior to 3.0.1.2, which stems from a vulnerability that allows an attacker to bypass its browser unlock feature...

The vulnerability of Firefox’s Reader Mode in the iOS browser allows a hacker to gain unauthorized access to protected information and perform cross-site scripting attacks.

The vulnerability of Firefox’s Reader Mode for iOS relates to the lack of measures taken to eliminate HTML tags. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information and perform cross-site scripting attacks...

google-translate-api-browser Code Issue Vulnerability

google-translate-api-browser is the free and unlimited Google Translate API. A code issue vulnerability exists in versions of google-translate-api-browser prior to 4.1.0, which stems from the translateOptions.tld field not being properly cleaned before being placed in a Google Translate URL. An...

CVE-2023-48094

A cross-site scripting XSS vulnerability in CesiumJS v1.111 allows attackers to execute arbitrary code in the context of the victim's browser via sending a crafted payload to /containerfiles/publichtml/doc/index.html. NOTE: the vendor’s position is that Apps/Sandcastle/standalone.html is part of...

CVE-2023-5950 Rapid7 Velociraptor Reflected XSS

This advisory covers a specific issue identified in Velociraptor and disclosed by a security code review. We want to thank Mathias Kujala for working with the Velociraptor team to identify and rectify this issue. It has been fixed as of Version 0.7.0-4, released November 6, 2023. CVSS · HIGH ·...

The vulnerability of the Brave Browser lies in its improper resource cleaning or release mechanisms, which allows a malicious actor to trigger a service failure.

The vulnerability of the Brave Browser is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures through a specially created HTML file...

Cross-site Scripting (XSS)

github.com/velocidex/velociraptor is vulnerable to Cross-site Scripting. This vulnerability exists because it does not properly validate error paths, allowing an attacker to inject and execute malicious JavaScript in the browser...

CVE-2023-36029

Microsoft Edge Chromium-based Spoofing Vulnerability...

Microsoft Edge (Chromium-based) Spoofing Vulnerability

...

sd-webui-infinite-image-browsing security vulnerability

sd-webui-infinite-image-browsing is an image browser by zanllp personal developer. A security vulnerability exists in versions prior to sd-webui-infinite-image-browsing 977815a, which stems from a vulnerability that allows a remote attacker to obtain local files if Gradio authentication is enable...

Cross site scripting

Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the backuppagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload...

CVE-2023-44488

A heap-based buffer overflow flaw was found in libvpx, a library used to process VP9 video codecs data. This issue occurs when processing certain specially formatted video data via a crafted HTML page, allowing an attacker to crash or remotely execute arbitrary code in an application, such as a w...

osCommerce Cross-Site Scripting Vulnerability

osCommerce is an open source online shopping e-commerce solution based on the GNUGPL license. osCommerce suffers from a cross-site scripting vulnerability that stems from susceptibility to a cross-site scripting XSS vulnerability that allows an attacker to execute unauthorized scripts in a user's...

Vulnerabilities in web browsers Firefox and Firefox ESR, as well as the email client Thunderbird, stem from insufficient checking of unusual or exceptional states, allowing attackers to exploit these vulnerabilities to compromise data integrity.

The vulnerabilities of web browsers Firefox, Firefox ESR, and the email client Thunderbird are related to insufficient checking of unusual or exceptional states. Exploiting these vulnerabilities can allow a remote attacker to compromise data integrity...

CVE-2023-40281

EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using t...

Cross-site Scripting (XSS) - Reflected

Description Reflected Cross-Site Scripting XSS vulnerability allows attackers to execute arbitrary external javascript code in the browser. In the application there exists a XSS vulnerability that occurs in the api: Payload: "alertwindow.location GET /system/api/restApiViewer: Passing XSS payload...

The vulnerability of the JBrowse browser, which allows for unlimited downloading of files of a malicious nature, enables attackers to execute arbitrary code.

The vulnerability of the JBrowse browser is related to the unlimited downloading of files of a malicious nature. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

CVE-2023-4051

CVE-2023-4051: The vulnerability relates to the full screen notification being obscured by the file Open dialog, potentially enabling user confusion and spoofing. Public details across connected documents identify the issue in Mozilla products including Firefox and Thunderbird before certain vers...

Apple Safari 安全漏洞

Apple Safari is a web browser from Apple Inc. and is the default browser that comes with the Mac OS X and iOS operating systems. A security vulnerability exists in Apple Safari versions prior to 16.6. An attacker can exploit the vulnerability to execute arbitrary code...

Cross-site Scripting (XSS)

tarteaucitronjs is vulnerable to Cross-Site Scripting. The vulnerability is due to a lack of user-input sanitization in width, theme, controls, img, and other parameters, which allows an attacker to inject and execute arbitrary JavaScript into the browser...