Creating Awareness of External JavaScript Libraries in Web Applications

Qualys Web Application Scanning WAS routinely reviews and solicits customer feedback regarding vulnerabilities. This may be to enhance the detection or the detections reporting. Previously, all JavaScript libraries detected on an application are reported under the Information Gathering QID 150176...

ROS-20221007-05

Firefox browser vulnerability is related to a bounds error in HTML content processing. Exploitation The vulnerability could allow a remote attacker to create a customized website, trick the victim into opening it, cause memory corruption, and execute arbitrary code on the target system. the victi...

Ubuntu: Security Advisory (USN-5649-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5649-1: Firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, bypass Content Security Policy CSP or other security restrictions, conduct session fixation attacks, or...

USN-5649-1 firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, bypass Content Security Policy CSP or other security restrictions, conduct session fixation attacks, or...

Consensys: Sub-Domain Takeover at http://www.codefi.consensys.net/

Summary: Subdomain takeovers: A subdomain takeover occurs when an attacker gains control over a subdomain of a target domain. Typically, this happens when the subdomain has a canonical name CNAME in the Domain Name System DNS, but no host is providing content for it. This can happen because eithe...

GHSA-F36P-42JV-8RH2 Lithium vulnerable to Cross Site Scripting in provided Swagger-UI

Impact A XSS vulnerability in the provided outdated Swagger-UI is exploitable in applications using lithium with Swagger-UI enabled. This allows an attacker gain Remote Code Execution RCE and potentially exfiltrate secrets in the context of this swagger session. Patches The used swagger-ui was...

Lithium vulnerable to Cross Site Scripting in provided Swagger-UI

Impact A XSS vulnerability in the provided outdated Swagger-UI is exploitable in applications using lithium with Swagger-UI enabled. This allows an attacker gain Remote Code Execution RCE and potentially exfiltrate secrets in the context of this swagger session. Patches The used swagger-ui was...

PT-2022-28238 · Lithium +1 · Lithium +2

Name of the Vulnerable Software and Affected Versions: lithium with Swagger-UI enabled affected versions not specified Description: A XSS vulnerability in the provided Swagger-UI is exploitable in applications, allowing an attacker to gain Remote Code Execution RCE and potentially exfiltrate...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:6710)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:6710-1 advisory. - Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh tag CVE-2022-3033 - Mozilla: Bypassing...

Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2022:6711)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:6711-1 advisory. - Mozilla: Bypassing FeaturePolicy restrictions on transient pages CVE-2022-40959 - Mozilla: Data-race when parsing non-UTF-8 URLs in threads...

CVE-2022-38732

SnapCenter versions prior to 4.7 shipped without Content Security Policy CSP implemented which could allow certain types of attacks that otherwise would be prevented...

CVE-2022-38732

SnapCenter versions prior to 4.7 shipped without Content Security Policy CSP implemented which could allow certain types of attacks that otherwise would be prevented...

Code injection

SnapCenter versions prior to 4.7 shipped without Content Security Policy CSP implemented which could allow certain types of attacks that otherwise would be prevented...

CVE-2022-38732

CVE-2022-38732 affects NetApp SnapCenter prior to version 4.7. The issue arises from the absence of a Content Security Policy (CSP), which could allow certain types of attacks that CSP would otherwise mitigate. Red Hat and related feeds corroborate that older SnapCenter builds ship without CSP, c...

CVE-2022-38732

SnapCenter versions prior to 4.7 shipped without Content Security Policy CSP implemented which could allow certain types of attacks that otherwise would be prevented...

CVE-2022-38732

SnapCenter versions prior to 4.7 shipped without Content Security Policy CSP implemented which could allow certain types of attacks that otherwise would be prevented...

NetApp SnapCenter 安全漏洞

NetApp SnapCenter is a suite of applications from Network Appliance NetApp that provides the ability to back up, verify, clone, and restore NetApp storage systems. A security vulnerability exists in NetApp SnapCenter versions prior to 4.7 that stems from a failure to implement a content security...

PT-2022-24546 · Netapp · Snapcenter

Name of the Vulnerable Software and Affected Versions: SnapCenter versions prior to 4.7 Description: The issue is related to the absence of Content Security Policy CSP in SnapCenter, which could allow certain types of attacks that would otherwise be prevented. Recommendations: For SnapCenter...

UBUNTU-CVE-2022-40956

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...