2338 matches found
Mozilla Firefox Information Disclosure Vulnerability (CNVD-2021-15498)
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. An information disclosure vulnerability exists in Mozilla Firefox. The vulnerability stems from the fact that if a user clicks on a specially crafted PDF, it may obfuscate the leak of cross-domain...
CVE-2021-27375
Traefik before 2.4.5 allows the loading of IFRAME elements from other domains...
CVE-2021-27375: Improper Restriction of Rendered UI Layers or Frames
Traefik before 2.4.5 allows the loading of IFRAME elements from other domains...
CVE-2021-27231
Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer's domain name, leading to spoofing of services or email messages...
Mozilla Firefox 安全漏洞
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. An information disclosure vulnerability exists in Mozilla Firefox. The vulnerability stems from the fact that if a user clicks on a specially crafted PDF, it may obfuscate the leak of cross-domain...
Sixt GmbH & Co. Autovermietung KG BBP: Cross domain token leakage via Referer header
Summary: The password reset link of user account on critical sixt+ domain/product can be obtained using the page https://www.sixt.com/php/profile/loginorpasswordforgotten. This page requires email address and surname/lastname of the user to send password reset link on email. This link contains th...
VulnCheck KEV: CVE-2015-9251
jQuery before 3.0.0 is vulnerable to Cross-site Scripting XSS attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed...
Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop
More than a month into the discovery of Solorigate, investigations continue to unearth new details that prove it is one of the most sophisticated and protracted intrusion attacks of the decade. Our continued analysis of threat data shows that the attackers behind Solorigate are skilled campaign...
Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop
More than a month into the discovery of Solorigate, investigations continue to unearth new details that prove it is one of the most sophisticated and protracted intrusion attacks of the decade. Our continued analysis of threat data shows that the attackers behind Solorigate are skilled campaign...
WebView Vulnerability in X Browser
X Browser is a mobile browser for the Android platform. X Browser has a WebView vulnerability that can be exploited by an attacker to execute JS code across domains and take full control of a user's browser...
Increasing resilience against Solorigate and other sophisticated attacks with Microsoft Defender
Even as investigations into the sophisticated attack known as Solorigate are still underway, details and insights about the tools, patterns, and methods used by the attackers point to steps that organizations can take to improve their defenses against similar attacks. Solorigate is a cross-domai...
A Google Docs Bug Could Have Allowed Hackers See Your Private Documents
Google has patched a bug in its feedback tool incorporated across its services that could be exploited by an attacker to potentially steal screenshots of sensitive Google Docs documents simply by embedding them in a malicious website. The flaw was discovered on July 9 by security researcher Sreer...
Using Microsoft 365 Defender to protect against Solorigate
Microsoft security researchers continue to investigate and respond to the sophisticated cyberattack known as Solorigate also referred to as Sunburst by FireEye involving a supply chain compromise and the subsequent compromise of cloud assets. While the related investigations and impact assessment...
Open Zaak Access Control Error Vulnerability
Open Zaak is a Python-based data and service layer application from the Open Zaak team. The software can Zaakgericht Werken interact. Open Zaak before version 1.3.3 suffers from an Access Control Error vulnerability that stems from the fact that the cross-domain resource sharing policy is current...
Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain
A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity...
Debian DSA-4812-1 : xen - security update
Multiple vulnerabilities have been discovered in the Xen hypervisor : Several security issues affecting Xenstore could result in cross domain access denial of service, information leaks or privilege escalation or denial of service against xenstored. Additional vulnerabilities could result in...
Unspecified Vulnerability in Mozilla FireFox (CNVD-2021-00393)
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 83, which stems from the fact that a cross-domain iframe containing a login form may have been recognized and populated by the login...
Cisco IoT Field Network Director SOAP API Authorization Bypass Vulnerability
Cisco IoT Field Network Director FND is a network management system for large-scale FAN deployments. A SOAP API authorization bypass vulnerability exists in Cisco IoT Field Network Director versions prior to 4.6.1. The vulnerability stems from insufficient authorization of the SOAP API. An attack...
November 19, 2020—KB4594441 (OS Build 14393.4048) Out-of-band
None None...
CVE-2020-26080
A vulnerability in the user management functionality of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to manage user information for users in different domains on an affected system. The vulnerability is due to improper domain access control. An attacker could...