CVE-2021-25988 ifme - Stored Cross-Site Scripting (XSS) in Notifications section

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability notifications section which can be directly triggered by sending an ally request to the admin...

CVE-2021-25988 ifme - Stored Cross-Site Scripting (XSS) in Notifications section

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability notifications section which can be directly triggered by sending an ally request to the admin...

Ifme 跨站脚本漏洞

Ifme is open source a mental health experience community that encourages people to share their personal stories with trusted allies. Ifme suffers from a cross-site scripting vulnerability in versions v1.0.0 through v7.31.4, which stems from a lack of checksum filtering of user-supplied and output...

The vulnerability of the Mozilla Firefox browser and the Mozilla Thunderbird email client, related to errors in cryptographic transformations, allows attackers to perform spear-phishing attacks.

The vulnerability of the Mozilla Firefox browser is related to errors in cryptographic transformations. Exploiting this vulnerability allows a remote attacker to conceal notifications for pages and perform spear-phishing attacks...

Apache Log4j Remote Code Execution Vulnerability

Certain versions of Apache Log4j2 are vulnerable to a remote code execution vulnerability. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. Microsoft is not aware of any impact to th...

CVE-2021-1021

In snoozeNotificationInt of NotificationManagerService.java, there is a possible way to disable notification for an arbitrary user due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for...

CVE-2021-40171

The absence of notifications regarding an ongoing RF jamming attack in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BGU-ITR-F1-BDBL.A30.20181117, allows an attacker to block legitimate traffic while not alerting the owner of the system...

Verint Systems Verint Workforce Optimization 跨站脚本漏洞

Verint Systems Verint Workforce Optimization WFO is a workforce performance management solution from Verint Systems, Inc. A cross-site scripting vulnerability exists in version 8.10048, which stems from a lack of data validation filtering of user-supplied data and output. An attacker could exploi...

PT-2021-22829 · Unknown · Securitashome

Name of the Vulnerable Software and Affected Versions: SecuritasHome home alarm system version HPGW-G 0.0.2.23F BG U-ITR-F1-BD BL.A30.20181117 Description: The issue concerns the absence of notifications for ongoing RF jamming attacks in the system. This allows an attacker to block legitimate...

CVE-2021-22565

An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater...

CVE-2021-22565

An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater...

CVE-2021-22565

CVE-2021-22565 affects the Google Exposure Notifications Verification Server. Root cause: insufficient granularity of access control in the verification-server component, enabling an attacker with permission to expire verification codes to invalidate codes that belong to another realm if the UUID...

CVE-2021-22565 Insufficient Granularity of Access Control in GAEN Notification Server

An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater...

Google Exposure Notifications Verification Server 安全漏洞

Google Exposure Notifications Verification Server is an open source Covid-19 Exposure Notifications verification component from Google USA. A security vulnerability exists in versions prior to Google Exposure Notifications Verification Server V1.1.2, which can be exploited by an attacker to...

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 91.4.0 ESR. Security Fixes: Mozilla: Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4 Mozilla: URL leakage when navigating while...

Mozilla Firefox 竞争条件问题漏洞

Mozilla Firefox is an open source Web browser from the Mozilla Foundation. Mozilla Firefox is vulnerable to a conditional competition issue, which could be exploited by an attacker to force a notification to receive full-screen and pointer-locked access to the page...

Pegasus Spyware Infects U.S. State Department iPhones

An unknown assailant planted NSO Group’s Pegasus spyware on the iPhones of at least nine U.S. State Department employees, according to four of Reuters’ sources who are familiar with the matter. Two of the sources said that the attacks took place over the last several months, hitting targets eithe...

Pegasus Spyware Reportedly Hacked iPhones of U.S. State Department and Diplomats

Apple reportedly notified several U.S. Embassy and State Department employees that their iPhones may have been targeted by an unknown assailant using state-sponsored spyware created by the controversial Israeli company NSO Group, according to multiple reports from Reuters and The Washington Post...

GHSA-3M3H-V9HV-9J4H Cross-site Scripting in django-wiki

In Django-wiki, versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting XSS in Notifications Section. An attacker who has access to edit pages can inject JavaScript payload in the title field. When a victim gets a notification regarding the changes made in the application, the...

Cross-site Scripting in django-wiki

In Django-wiki, versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting XSS in Notifications Section. An attacker who has access to edit pages can inject JavaScript payload in the title field. When a victim gets a notification regarding the changes made in the application, the...