The vulnerability of software such as Google Chrome, Firefox, Firefox ESR, and Thunderbird lies in a data source confirmation error, which allows attackers to gain access to confidential data.

The vulnerability of the Google Chrome, Firefox, Firefox ESR, and Thunderbird software lies in a data source confirmation error. Exploiting this vulnerability allows an attacker to gain access to confidential data remotely...

CVE-2021-25428

Improper validation check vulnerability in PackageManager prior to SMR July-2021 Release 1 allows untrusted applications to get dangerous level permission without user confirmation in limited circumstances...

CVE-2021-25428

Improper validation check vulnerability in PackageManager prior to SMR July-2021 Release 1 allows untrusted applications to get dangerous level permission without user confirmation in limited circumstances...

PackageManager安全漏洞

Samsung PackageManager is an application from Samsung Korea. A security vulnerability exists in versions prior to Samsung PackageManager SMR July-2021 Release 1, which can be exploited by attackers to gain dangerous levels of privileges without user confirmation in limited circumstances...

MGASA-2021-0306 Updated thunar packages fix a security vulnerability

An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program based on the file type without user confirmation. This could be used to achieve code execution CVE-2021-32563...

CVE-2021-32718

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper tag sanitization, potentially allowing for JavaScript code execution in the...

Unused return value from Transfer()/ TransferFrom()

Handle JMukesh Vulnerability details Impact return value from transfer/ transferFrom confirm the success of that function call, these return should be checked Proof of Concept Tools Used Manual analysis Recommended Mitigation Steps utilise the return value to check the success of the function ---...

CVE-2021-22214

creationtimestamp| type| source ---|---|--- 2021-06-20 07:41:59+00:00| seen| https://t.me/pwnwikizhchannel/682 2021-06-26 13:37:04+00:00| seen| https://t.me/bhhub/410 2021-11-01 04:09:28+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/784 2021-11-03 11:00:10+00:00|...

unlv.edu Cross Site Scripting vulnerability OBB-2053193

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| unlv.edu ---|--- Open Bug Bounty...

CVE-2021-24317

The Listeo WordPress theme before 1.6.11 did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message pages, leading to Cross-Site Scripting issues...

CVE-2021-24317

The Listeo WordPress theme before 1.6.11 did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message pages, leading to Cross-Site Scripting issues...

CVE-2020-26559

Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device participating in the provisioning protocol to identify the AuthValue used given the Provisioner’s public key, and the confirmation number and nonce provided by the provisioning device. This could...

CVE-2020-26559

CVE-2020-26559 (Bluetooth Mesh Provisioning) affects Bluetooth Mesh provisioning (Mesh profile 1.0/1.0.1). A nearby attacker participating in the provisioning protocol can identify the AuthValue and the provisioning device’s confirmation number and nonce, potentially enabling provisioning complet...

Listeo < 1.6.11 - Multiple XSS & XFS vulnerabilities

The theme did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message pages, leading to Cross-Site Scripting issues - Unauthenticated Reflected XSS | Search query, vulnerable parameters: keywordsearch and locationsearch - Authenticated Persistent XSS & XFS |...

Listeo < 1.6.11 - Multiple XSS & XFS vulnerabilities

The theme did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message pages, leading to Cross-Site Scripting issues - Unauthenticated Reflected XSS | Search query, vulnerable parameters: keywordsearch and locationsearch - Authenticated Persistent XSS & XFS |...

CVE-2021-31897

CVE-2021-31897 affects JetBrains WebStorm prior to 2021.1, where code execution without user confirmation was possible for untrusted projects. The vulnerability is documented across multiple sources (NVD entry and Red Hat advisory) and is addressed in WebStorm 2021.1 per JetBrains’ Q1 2021 Securi...

DEBIAN-CVE-2021-32563

An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program based on the file type without user confirmation. This could be used to achieve code execution...

Denial Of Service (DoS)

matrix-synapse is vulnerable to denial of service. The vulnerability exists due to missing input validation of some parameters on the endpoints used to confirm third-party identifiers...

Cross-site scripting (XSS) vulnerability in the password reset endpoint

Impact The password reset endpoint served via Synapse was vulnerable to cross-site scripting XSS attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources...

HackerOne: Used email confirmation link reveals the email address which is tied to it

Summary: If an attacker finds an used email confirmation link the token is in URL s/he will be able to see the email address which is tied to the confirmation link ID. The attack itself is pretty unlikely but the application should show the generic error message like The confirmation ID is invali...