Mozilla: XMLHttpRequest error codes could have leaked the existence of an external protocol handler

Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

CVE-2021-43542

Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

CVE-2021-43542

Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

Mozilla: XMLHttpRequest error codes could have leaked the existence of an external protocol handler

Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

Mozilla: XMLHttpRequest error codes could have leaked the existence of an external protocol handler

Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

Mozilla: XMLHttpRequest error codes could have leaked the existence of an external protocol handler

Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

CVE-2021-43542

Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

Grafana -- Path Traversal

Grafana Labs reports: Grafana is vulnerable to directory traversal, allowing access to local files. We have confirmed this for versions v8.0.0-beta1 to v8.3.0. Thanks to our defense-in-depth approach, at no time has Grafana Cloud been vulnerable. The vulnerable URL path is: /public/plugins/ where...

CVE-2021-39341 OptinMonster <= 2.6.4 Unprotected REST-API Endpoints

The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the loggedinorhasapikey function in the /OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with...

Citrix Personalization For App-V - VDA Installed (Windows)

Binary data citrixpersonalizationappvvdawininstalled.nbin...

The vulnerability of the /etc/passwd component in the D-Link DSR-500N router’s microprogramming system allows a hacker to gain access to the device’s basic embedded Linux operating system.

The vulnerability of the /etc/passwd component in the D-Link DSR-500N router’s microprogramming system is related to the use of pre-installed user accounts. Exploiting this vulnerability could allow a malicious actor to gain access to the device’s basic embedded Linux operating system...

Fedora 35 : firefox (2021-60aef08c1b)

The remote Fedora 35 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-60aef08c1b advisory. - - New upstream update 93.0 - Fixed NSS package dependency NSS 3.70 ---- - New upstream release 93.0 FEDORA-2021-60aef08c1b Note that Nessus has not tested...

GHSA-3R3G-G73X-G593 coreos-installer improperly verifies GPG signature when decompressing gzipped artifact

Impact coreos-installer fails to correctly verify GPG signatures when decompressing gzip-compressed artifacts. This allows bypass of signature verification in cases where coreos-installer decompresses a downloaded OS image, allowing an attacker who can modify the OS image to compromise a...

VMware vCenter Managed ESXi Installed VIBs

Binary data vmwarevcenterinstalledvibs.nbin...

Elastic Elasticsearch Installed (Linux)

Binary data elasticelasticsearchnixinstalled.nbin...

The vulnerability of the KR C4 production automation control system and the operating system KSS, related to the use of pre-installed account data, allows a perpetrator to gain full access to the vulnerable system.

The vulnerability of the KR C4 production automation control system and the KSS operating system is related to the use of pre-installed account data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain full access to the vulnerable systems...

The vulnerability of the KR C4 production automation control system and the operating system KSS, related to the use of pre-installed account data, allows a perpetrator to gain full access to the system.

The vulnerability of the KR C4 production automation control system and the KSS operating system is related to the use of pre-installed account data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain full access to the system...

OS Command Injection in zacanger/is-program-installed

✍️ Description There is "OS Command Injection" vulnerability on "is-program-installed" npm package. This package tries to understand the given parameter name program or binary name is installed in the computer or not. However, since this package does not properly control the characters in the...

Microsoft Visual Studio Code Extensions Installed (macOS)

Binary data macosmicrosoftvisualstudiocodeextensionsinstalled.nbin...

The vulnerability of the Vijeo Designer Basic and Vijeo Designer software, related to the use of pre-installed credentials, allows a perpetrator to gain unauthorized access to protected information.

It is related to the use of pre-installed account data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...