388 matches found
Mozilla: Drag and Dropped Filenames could have been truncated to malicious extensions
The Mozilla Foundation Security Advisory describes this flaw as: A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code...
Mozilla: Drag and Dropped Filenames could have been truncated to malicious extensions
The Mozilla Foundation Security Advisory describes this flaw as: A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code...
PT-2022-27763 · Unknown · Drag/Drop Xblock
Name of the Vulnerable Software and Affected Versions: Drag and Drop XBlock v2 versions prior to 3.0.0 Description: The issue affects the Drag and Drop XBlock v2, which implements a drag-and-drop style problem. It is vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that...
PT-2022-24250 · F Secure · F-Secure Safe Browser
Name of the Vulnerable Software and Affected Versions: F-Secure SAFE Browser versions prior to 19.0 Description: A Drag and Drop spoof vulnerability was discovered, allowing a spoofing of the address bar when a user performs a drag and drop operation on the address bar. Recommendations: For...
USN-5504-1 firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the browser UI, bypass CSP restrictions, bypass sandboxed iframe restrictions, obtain sensitive...
UBUNTU-CVE-2022-34482
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from...
CVE-2022-1569: Improper Neutralization of Input During Web Page Generation
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before 1.4.9.4 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks...
PT-2022-13968
Name of the Vulnerable Software and Affected Versions The Drag & Drop Builder WordPress plugin versions prior to 1.4.9.4 Description The issue is related to the lack of sanitization and escaping of some form fields in the plugin, which could allow high privilege users, such as admins, to perform...
WordPress Drag & Drop Builder plugin <= 1.4.9.3 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability was discovered by Hitesh Kumar in WordPress Drag & Drop Builder plugin versions = 1.4.9.3. Solution Update the WordPress Drag & Drop Builder plugin to the latest available version at least 1.4.9.4...
CVE-2021-24689
The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack...
CVE-2021-24689
CVE-2021-24689 concerns the WordPress plugin Contact Forms - Drag & Drop Contact Form Builder (versions up to 1.0.5). The vulnerability is a path traversal flaw that allows high-privilege users to download arbitrary files from the web server, via the plugin’s file download feature. The core issue...
WordPress Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung plugin <= 1.2 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung plugin versions = 1.2. Solution No patched version available...
WordPress Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung plugin <= 1.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung plugin versions = 1.2. Solution No patched version available...
CVE-2021-24689: Improper Limitation of a Pathname to a Restricted Directory
The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack...
PT-2022-9448
Name of the Vulnerable Software and Affected Versions The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin versions 1.0.0 through 1.0.5 Description The issue allows high privilege users to download arbitrary files from the web server via a path traversal attack. Recommendations F...
Mozilla: Drag and dropping an image could have resulted in the dropped object being an executable
The Mozilla Foundation Security Advisory describes this flaw as: If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script, which would have run arbitrary code after the user clicked it...
Mozilla Firefox 安全漏洞
Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP, POP mail protocols and HTML mail format. An arbitrary code execution vulnerability exists in Mozilla Thunderbird versions prior to...
CVE-2020-8292
Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting XSS vulnerability via the drag & drop functionality in message boxes...
