URIjs Hostname spoofing via backslashes in URL

Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a backslash \ character as part of the scheme delimiter, e.g. scheme:/\hostname. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and...

Déjà vu-lnerability

A Year in Review of 0-days Exploited In-The-Wild in 2020 Posted by Maddie Stone, Project Zero 2020 was a year full of 0-day exploits. Many of the Internet’s most popular browsers had their moment in the spotlight. Memory corruption is still the name of the game and how the vast majority of detect...

The vulnerability of Adobe Experience Manager’s content and media data management system, related to the lack of measures taken to protect the structure of web pages, allows attackers to execute arbitrary JavaScript code in the user’s browser.

The vulnerability of the Adobe Experience Manager content and media data management system is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code in the user’s browser using a specially crafted...

CVE-2021-22872

Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting XSS vulnerability via the publicly accessible afr.php delivery script. While this issue was previously addressed in modern browsers as CVE-2020-8115, some older browsers e.g., IE10 that do not automatically URL encode...

Cross site scripting

Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting XSS vulnerability via the publicly accessible afr.php delivery script. While this issue was previously addressed in modern browsers as CVE-2020-8115, some older browsers e.g., IE10 that do not automatically URL encode...

jenkins -- Arbitrary file read vulnerability in workspace browsers

Jenkins Security Advisory: Description Medium SECURITY-2197 / CVE-2021-21615 Arbitrary file read vulnerability in workspace browsers...

VulnCheck KEV: CVE-2021-21148

Google Chromium V8 Engine contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome,...

CVE-2021-22872

Revive Adserver

KLA12049 Multiple vulnerabilities in Microsoft Browsers

Multiple vulnerabilities were found in Microsoft Browsers. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, bypass security restrictions, spoof user interface. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in WebS...

The vulnerability of Firefox browsers, Firefox ESR, and the Thunderbird email client, related to insufficient input validation, allows attackers to carry out spear-phishing attacks.

The vulnerabilities of Firefox browsers, Firefox ESR, and the email client Thunderbird are related to insufficient validation of input data. Exploiting these vulnerabilities can allow attackers to perform spear-phishing attacks remotely...

The vulnerabilities of Firefox browsers, Firefox ESR, and the Thunderbird email client, related to the use of freed resources, allow attackers to gain unauthorized access to information and compromise its integrity and accessibility.

The vulnerabilities of Firefox browsers, Firefox ESR, and the email client Thunderbird are related to the use of after-release components. Exploiting these vulnerabilities can allow a remote attacker to gain unauthorized access to information and compromise its integrity and availability...

The vulnerability in the memory of Firefox web browsers, Firefox ESR, and the Thunderbird email client involves an operation that goes beyond the allowed limits of the data buffer. This allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability in the memory of Firefox web browsers, Firefox ESR, and the Thunderbird email client relates to the execution of operations beyond the allowed boundaries of the data buffer. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its...

The vulnerability of Firefox browsers, Firefox ESR, and the Thunderbird email client, related to the use of after-freeing mechanisms, allows a hacker to trigger a service failure.

The vulnerabilities of Firefox browsers, Firefox ESR, and the email client Thunderbird are related to the use of after-release components. Exploiting these vulnerabilities can allow a malicious actor to cause service interruptions using a specially created malware script...

KLA12039 ACE vulnerability in Microsoft Browsers

A memory corruption vulnerability was found in Microsoft Browsers. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2021-1705 Related products Microsoft-Edge CVE list CVE-2021-1705 critical KB list 4598243 4598231 4598229 4598242 4598230 4598245...

Adobe Acrobat Reader Silent PDF Exploit 0day

0day PDF Exploit. All Chrome, Edge, Opera, Firefox, Microsoft Internet Explorer, Yandex, tested. Running smoothly Latest version. Adobe Acrobat Reader Works Seamlessly with All Versions of DC Latest version. Windows 7, Windows 8, Windows 8.1, Windows 10 Tested Works in the latest versions. All Ma...

The vulnerability in the WebGL component of Firefox browsers, Firefox ESR, and the Thunderbird email client allows a hacker to trigger a service failure.

The vulnerability of the WebGL component in Firefox browsers, Firefox ESR, and the email client Thunderbird is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

HCL Verse Cross-Site Scripting Vulnerability

HCL Verse is a mobile application for accessing emails and life plan management from HCL India. A cross-site scripting vulnerability exists in HCL Verse v10 and v11, which stems from mishandling of message content and is susceptible to stored cross-site scripting attacks XSS. A remote attacker...

[SECURITY] Fedora 33 Update: php-oojs-oojs-ui-0.39.3-1.fc33

OOjs UI Object-Oriented JavaScript =EF=BF=BD=EF=BF=BD=EF=BF=BD User Interf ace is a library that allows developers to rapidly create front-end web applications that operate consistently across a multitude of browsers...

EulerOS 2.0 SP8 : squid (EulerOS-SA-2020-2534)

According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Squid before 4.9, when certain web browsers are used, mishandles HTML in the host aka hostname parameter to cachemgr.cgi.CVE-2019-18860 - An issue...

Watch Out! Adrozek Malware Hijacking Chrome, Firefox, Edge, Yandex Browsers

Microsoft on Thursday took the wraps off an ongoing campaign impacting popular web browsers that stealthily injects malware-infested ads into search results to earn money via affiliate advertising. "Adrozek," as it's called by the Microsoft 365 Defender Research Team, employs an "expansive, dynam...