Security Bulletin: Multiple vulnerabilities in IBM Cognos Command Center

Summary There are vulnerabilities in IBM® Semeru Java™ used by IBM Cognos Command Center. Additionally, IBM Cognos Command Center is vulnerable to Open redirection, Clickjacking and Arbitary code execution vulnerabilities. This Security Bulletin relates only to the direct usage of third-party...

IBM Cognos Command Center security vulnerabilities

IBM Cognos Command Center is a solution for automating business processes that simplifies operational complexity across multiple software environments by allowing users to view, execute and monitor automated processes through a single interface. A clickjacking vulnerability exists in IBM Cognos...

⚡ Weekly Recap: Password Manager Flaws, Apple 0-Day, Hidden AI Prompts, In-the-Wild Exploits & More

Cybersecurity today moves at the pace of global politics. A single breach can ripple across supply chains, turn a software flaw into leverage, or shift who holds the upper hand. For leaders, this means defense isn't just a matter of firewalls and patches—it's about strategy. The strongest...

⚡ Weekly Recap: Password Manager Flaws, Apple 0-Day, Hidden AI Prompts, In-the-Wild Exploits & More

Cybersecurity today moves at the pace of global politics. A single breach can ripple across supply chains, turn a software flaw into leverage, or shift who holds the upper hand. For leaders, this means defense isn’t just a matter of firewalls and patches—it’s about strategy. The strongest...

A week in security (August 18 – August 24)

Last week on Malwarebytes Labs: Clickjack attack steals password managers’ secrets Grok chats show up in Google searches All Apple users should update after company patches zero-day vulnerability in all platforms Google settles YouTube lawsuit over kids’ privacy invasion and data collection...

Linux Distros Unpatched Vulnerability : CVE-2017-6504

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking. CVE-2017-6504 Note that Nessus relies o...

Clickjack attack steals password managers’ secrets

Sometimes it can seem as though everything's toxic online, and the latest good thing turned bad is here: Browser pop-ups that look like they're trying to help or authenticate you could be programmed to steal data from your password manager. To make matters worse, most browser extension-based...

DOM-Based Extension Clickjacking Exposes Popular Password Managers to Credential and Data Theft

Popular password manager plugins for web browsers have been found susceptible to clickjacking security vulnerabilities that could be exploited to steal account credentials, two-factor authentication 2FA codes, and credit card details under certain conditions. The technique has been dubbed Documen...

DOM-Based Extension Clickjacking Exposes Popular Password Managers to Credential and Data Theft

Popular password manager plugins for web browsers have been found susceptible to clickjacking security vulnerabilities that could be exploited to steal account credentials, two-factor authentication 2FA codes, and credit card details under certain conditions. The technique has been dubbed Documen...

IBM Datacap Navigator Clickjacking

The vulnerability in the IBM Datacap Navigator software, a document collection and processing tool, relates to the user interface’s false representation of critical information. Exploiting this vulnerability could allow an attacker to carry out a clickjacking attack remotely...

IBM Datacap Navigator Clickjacking

The vulnerability in the IBM Datacap Navigator software, a document collection and processing tool, relates to an improper limitation on the visible layers of the user interface. Exploiting this vulnerability could allow a malicious actor to carry out a clickjacking attack remotely...

Linux Distros Unpatched Vulnerability : CVE-2025-5267

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Red Hat Enterprise Linux - firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details Ubuntu Linux - A clickjacking...

Linux Distros Unpatched Vulnerability : CVE-2020-26962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated. This could have been used in...

Linux Distros Unpatched Vulnerability : CVE-2025-6434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker ...

Linux Distros Unpatched Vulnerability : CVE-2021-29987

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still...

Brave Desktop 1.81.131 Security Fixes

Added clickjacking protection on DDNS interstitials as reported on HackerOne by newfunction. - Fixed inactive split view tab displaying a permission prompt as reported on HackerOne by frozzipies. Upgraded Chromium to 139.0.7258.66 — refer to Google Chrome advisories for inherited CVEs...

Brave Android 1.81.131 Security Fixes

Added clickjacking protection on DDNS interstitials as reported on HackerOne by newfunction. Upgraded Chromium to 139.0.7258.66 — refer to Google Chrome advisories for inherited CVEs...

Linux Distros Unpatched Vulnerability : CVE-2024-2609

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites. This...

WakaTime: Double Clickjacking Attack on WakaTime OAuth Authorization Flow at https://wakatime.com/oauth/authorize

The WakaTime OAuth authorization flow was vulnerable to a double-clickjacking attack. The attack allowed an attacker to trick users into unknowingly clicking the "Connect my WakaTime account" button in the consent dialog, enabling the attacker to register an OAuth application, capture the...

RockyLinux 8 : thunderbird (RLSA-2025:8756)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:8756 advisory. thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link CVE-2025-3909 thunderbird: Sender Spoofing via Malformed From Header in...