1942 matches found
CVE-2021-39787
CVE-2021-39787 affects Android 12L SystemUI. The issue enables an arbitrary Activity launch via a confused deputy, resulting in local elevation of privilege with no extra execution privileges required and a required user interaction for exploitation. Affected component: SystemUI on Android-12L; r...
Welcome to Edge Diagnostics
After more than a year of dedication and hard work, we are delighted to officially announce the launch of our new Edge Diagnostics application on March 30, 2022. Diagnosing network and content issues quickly and effectively is critical to your success! Therefore the aim is to make the existing...
CVE-2021-39787: Externally Controlled Reference to a Resource in Another Sphere
In SystemUI, there is a possible arbitrary Activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-202506934...
CVE-2022-1075
CVE-2022-1075 affects College Website Management System 1.0. The vulnerable code path is /cwms/classes/Master.php?f=save_contact in the Contact Handler, where input manipulation can result in persistent cross-site scripting. The issue may be exploitable remotely and requires authentication. No re...
Citrix - Gateway as a service - Error Codes For Session Launch Failure
Multiple Error codes during session launch failures...
Flo Launch < 2.4.1 - Missing Authentication Allow Full Site Takeover
The plugin injects code into wp-config.php when creating a cloned site, allowing any attacker to initiate a new site install by setting the flocustomtableprefix cookie to an arbitrary value. PoC On any website where flo-launch is active create cookie "flocustomtableprefix" with any string value t...
Flo Launch < 2.4.1 - Missing Authentication Allow Full Site Takeover
The plugin injects code into wp-config.php when creating a cloned site, allowing any attacker to initiate a new site install by setting the flocustomtableprefix cookie to an arbitrary value. On any website where flo-launch is active create cookie "flocustomtableprefix" with any string value to...
WordPress Flo Launch plugin <= 2.4 - Missing Authentication Allows Full Site Takeover vulnerability
Missing Authentication Allows Full Site Takeover vulnerability discovered by Daniel Ruf in WordPress Flo Launch plugin versions = 2.4. Solution Update the WordPress Flo Launch plugin to the latest available version at least 2.4.1...
Unable to launch published apps through the Gateway, no errors
-The customer cannot launch apps when logging in to the NetScaler gateway -The applications enumerate but won't launch, the progress popup comes up and disappears with no errors...
Automatically launch the downloaded .ica files when using Chrome browser
When you try to launch a published application or desktop from a browser by browsing to storefront or gateway URL, an".ica"file is downloaded. You need to click the .ica file to launch the session instead of auto launch...
Spoofing attack in swagger-ui-dist
The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...
Important: thunderbird
Issue Overview: The Mozilla Foundation Security Advisory describes this flaw as: It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. CVE-2021-4140 The Mozilla Foundation Security Advisory describes this flaw as: Constructing audio sinks could have lea...
Design/Logic Flaw
IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack...
CVE-2022-25643
seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname...
CVE-2022-25643
seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname...
DEBIAN-CVE-2022-25643
seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname...
Design/Logic Flaw
seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname...
seatd-launch 权限许可和访问控制问题漏洞
Seatd is an administrative daemon. It is used to mediate access to shared devices graphics, input. seatd-launch A security vulnerability exists in seatd versions 0.6.x through 0.6.4, which stems from a lack of privilege restrictions in the software that allow files with escalated privileges to be...
CVE-2022-25643
seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname...
CVE-2022-25643
CVE-2022-25643 affects seatd-launch in seatd 0.6.x prior to 0.6.4. It allows removing files with escalated privileges when the binary is installed setuid root, with the attack vector being a user-supplied socket pathname. Public details in the provided document indicate the vulnerable condition a...