PT-2020-12310 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak version 10.0.1 Description: A flaw in the data filter of Keycloak allows the processing of data URLs under certain circumstances, enabling an attacker to conduct cross-site scripting or further attacks. Recommendations: For version...

Security update for grafana, grafana-piechart-panel, grafana-status-panel (moderate)

openSUSE Security Update: Security update for grafana, grafana-piechart-panel, grafana-status-panel Announcement ID: openSUSE-SU-2020:0892-1 Rating: moderate References: 1170557 Cross-References: CVE-2019-15043 CVE-2020-12245 CVE-2020-13379 Affected Products: openSUSE Leap 15.2 An update that fix...

CVE-2018-5142

If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not properly display the originating domain. The notification states "Unknown protocol" as the requestee, leading to user confusion about which site is asking for...

Mozilla: Blob and data URLs bypass phishing and malware protection warnings (MFSA 2017-22)

File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. This would allow malicious sites to lure users into downloading executables that would otherwise ...

CVE-2016-6845

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Script code within hyperlinks at HTML E-Mails is not getting correctly sanitized when using base64 encoded "data" resources. This allows an attacker to provide hyperlinks that may execute script code instead of directing to a...

Mozilla: Add-on notification bypass through data URLs (MFSA 2015-95)

A flaw was found in the way Firefox handled installation of add-ons. An attacker could use this flaw to bypass the add-on installation prompt, and trick the user into installing an add-on from a malicious source...

Spy Agencies Hijack Google Play Store to Install Spyware on Smartphones

I have an Android phone with a five different gmail accounts configured in it. But what if any one of them get compromised via phishing, malware or any other way? The Hacker would be able to access my Google account and obviously Google Play Store account too, which allows anyone to install any...