DuckDuckGo: XSS in Subdomain of DuckDuckGo

A cross-site scripting vulnerability was discovered in a subdomain of DuckDuckGo. The subdomain had a Content Security Policy header intended to prevent script execution, but this could be bypassed in Internet Explorer. As a result, malicious scripts could be injected and executed in the...

DuckDuckGo: SSRF in proxy.duckduckgo.com via the image_host parameter

Description https://proxy.duckduckgo.com/iur/ endpoint is vulnerable to ssrf via imagehost get parameter. Vulnerable URL: https://proxy.duckduckgo.com/iur/?f=1&imagehost=https://tudomanyok.hu/ Some internal URL: https://proxy.duckduckgo.com/iur/?f=1&imagehost=https://127.0.0.1:18091/...

DuckDuckGo Private IP Address Disclosure Vulnerability

DuckDuckGo is an extension for use in browsers. It is used to access the web anonymously.WebRTC component is a component used in it to support real-time voice conversations or video conversations in the browser. A security vulnerability exists in the WebRTC component in DuckDuckGo version 4.2.0. ...

Information disclosure

In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information such as https://ip.voidsec.com, the browser can disclose a private IP address in a STUN request...

CVE-2018-6849

In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information such as https://ip.voidsec.com, the browser can disclose a private IP address in a STUN request...

CVE-2018-6849

In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information such as https://ip.voidsec.com, the browser can disclose a private IP address in a STUN request...

CVE-2018-6849

In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information such as https://ip.voidsec.com, the browser can disclose a private IP address in a STUN request...

CVE-2018-6849

CVE-2018-6849 affects the WebRTC component in DuckDuckGo 4.2.0, enabling leakage of a client’s private IP address in a STUN request after visiting a site that tries to enumerate network information (e.g., ip.voidsec.com). The vulnerability description and multiple connected sources confirm the is...

CVE-2018-6849: Exposure of Sensitive Information to an Unauthorized Actor

In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information such as https://ip.voidsec.com, the browser can disclose a private IP address in a STUN request...

Vivaldi browser puts DuckDuckGo as default search engine for private windows

By Waqas DuckDuckGo search engine and Vivaldi browser are joining hands together to collaborate This is a post from HackRead.com Read the original post: Vivaldi browser puts DuckDuckGo as default search engine for private windows...

duckduckgo.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-516040 Description| Value ---|--- Affected Website:| duckduckgo.com Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Disclosure Standard:| Coordinated Disclosure based on ISO...

duckduckgo.com XSS vulnerability

Vulnerable URL: https://duckduckgo.com/iu/?u=http://localdomain.pw/ddg/=1 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 347 VIP website status:| Yes Coordinated Disclosure Timeline: Description| Value ---|---...

duckduckgo.com XSS vulnerability

Vulnerable URL: https://duckduckgo.com//html?q=?%2522%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 501 VIP website status:| Yes Coordinated Disclosure Timeline:...

DuckDuckGo Search & Stories - Customized SSL, Runtime privilege escalation vulnerabilities

HackApp vulnerability scanner discovered that application DuckDuckGo Search & Stories published at the 'play' market has multiple vulnerabilities...

SpiderFoot v2.6.1 - Open Source Intelligence Automation

SpiderFoot is an open source intelligence automation tool. Its goal is to automate the process of gathering intelligence about a given target. Purpose There are three main areas where SpiderFoot can be useful: 1. If you are a pen-tester, SpiderFoot will automate the reconnaisance stage of the tes...

For Better Privacy & Security, Change these iOS 9 Settings Immediately

iOS 9 is out, and it's time to update your iPhone or iPad to the latest version of Apple's mobile operating system. The new iOS is better, faster, and more efficient than its predecessors, with a number of new features and improvements including enhanced multitasking for iPad, Proactive Assistant...

duckduckgo.com XSS vulnerability

Vulnerable URL: https://duckduckgo.com/?q=xss+site:heroesofmightand.com=-1'"=1 Details: Description| Value ---|--- Patched:| Yes, at 04.08.2015 Latest check for patch:| 04.08.2015 04:49 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 502 Google Pagerank| 7 VIP...

Google Engineers Critical Aviator Browser Privacy, Security

Within hours on Thursday of WhiteHat Security releasing its Aviator browser to open source, a remote code execution vulnerability was disclosed, along with a handful of other coding issues that Google security engineers said jeopardized the security and privacy of Aviator’s users. Google’s public...

openSUSE Security Update : MozillaFirefox (openSUSE-SU-2014:1581-1)

This MozillaFirefox update fixes several security and non security issues. Changes in MozillaFirefox : - update to Firefox 34.0.5 bnc908009 - Default search engine changed to Yahoo! for North America - Default search engine changed to Yandex for Belarusian, Kazakh, and Russian locales - Improved...

openSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:0946-1)

MozillaFirefox was updated to Firefox 21.0 bnc819204 - MFSA 2013-41/CVE-2013-0801/CVE-2013-1669 Miscellaneous memory safety hazards - MFSA 2013-42/CVE-2013-1670 bmo853709 Privileged access for content level constructor - MFSA 2013-43/CVE-2013-1671 bmo842255 File input control has access to full...