Mozilla Firefox has an unspecified vulnerability (CNVD-2021-101164)

Mozilla Firefox is an open source web browser from the Mozilla Foundation. Mozilla Firefox is vulnerable due to an unusual sequence of events controlled by an attacker, and alert can therefore display arbitrary albeit unstyled content on top of an uncontrolled page of the attacker's choice...

Mozilla: Use-after-free in file picker dialog

The Mozilla Foundation Security Advisory describes this flaw as: When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have resulted, leading to memory corruption and a potentially exploitable crash...

cleanunet (0.0.1), cryptoadvance-specter (>=0.0.2, <=0.2.0) +25 more potentially affected by CVE-2020-10378 via pillow (6.2.0)

pillow PYPI version 6.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - cleanunet 0.0.1 - cryptoadvance-specter =0.0.2, =2.3.0rc2, =5.0.3, =0.1.4, =0.0.3, =0.1.9, =0.0.1, =1.13.0.dev5, =0.4.3, =0.4.4 and more Source cves...

Mozilla Thunderbird < 91.3

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-50 advisory. - The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass...

CVE-2021-38504

When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have resulted, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox 94, Thunderbird 91.3, and Firefox ESR 91.3...

Security Vulnerabilities fixed in Firefox ESR 91.3 — Mozilla

The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame. When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have...

Mozilla Firefox security vulnerabilities

Mozilla Firefox is an open source web browser from the Mozilla Foundation. Mozilla Firefox is vulnerable due to an unusual sequence of events controlled by an attacker, and alert can therefore display arbitrary albeit unstyled content on top of an uncontrolled page of the attacker's choice...

PT-2021-4943

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 94 Thunderbird versions prior to 91.3 Firefox ESR versions prior to 91.3 Description A use-after-free issue could occur when interacting with an HTML input element's file picker dialog with the webkitdirectory attribu...

KLA12335 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to obtain sensitive information, spoof user interface, bypass security restrictions, execute arbitrary code, cause denial of service, perform cross-site scripting attack. Below is a complete...

ASB-A-172251622

In onCreate of CompanionDeviceActivity.java or DeviceChooserActivity.java, there is a possible way for HTML tags to interfere with a consent dialog due to improper input validation. This could lead to remote escalation of privilege, confusing the user into accepting pairing of a malicious Bluetoo...

CVE-2021-0583

In onCreate of BluetoothPairingDialog, there is a possible way to enable Bluetooth without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...

CVE-2021-0583

In onCreate of BluetoothPairingDialog, there is a possible way to enable Bluetooth without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...

Design/Logic Flaw

In onCreate of BluetoothPairingDialog, there is a possible way to enable Bluetooth without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...

October 5, 2021, update for Office 2016 (KB4462197)

None None...

CVE-2021-41463

Cross-site scripting XSS vulnerability in toos/permissions/dialogs/access/entity/types/groupcombination.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the cID parameter...

PortlandLabs Concrete CMS Cross-Site Request Forgery Vulnerability (CNVD-2021-76080)

PortlandLabs Concrete Cms is a team-oriented open source content management system for the United States PortlandLabs . A cross-site request forgery vulnerability exists in PortlandLabs Concrete CMS, which stems from a failure to validate CCM tokens when adding a save endpoint to the product's...

PortlandLabs Concrete Cms Cross-Site Request Forgery Vulnerability

PortlandLabs Concrete Cms is a team-oriented open source content management system for the United States PortlandLabs . A cross-site request forgery vulnerability exists in PortlandLabs Concrete CMS, which stems from a failure to validate CCM tokens when adding a save endpoint to the product's...

Cross-site Scripting in yourls

yourls is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in edit dialog...

GHSA-M9FQ-C9HP-59G7 Cross-site Scripting in yourls

yourls is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in edit dialog...

CVE-2021-24600

The WP Dialog WordPress plugin through 1.2.5.5 does not sanitise and escape some of its settings before outputting them in pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...