CVE-2018-5141

A vulnerability in the notifications Push API where notifications can be sent through service workers by web content without direct user interaction. This could be used to open new tabs in a denial of service DOS attack or to display unwanted content from arbitrary URLs to users. This vulnerabili...

CVE-2018-5141

CVE-2018-5141 is a vulnerability in the Firefox Push API where notifications can be triggered by web content via service workers without direct user interaction, potentially allowing opening new tabs or displaying content from arbitrary URLs. The connected documents confirm this affects Firefox v...

CVE-2018-5142

If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not properly display the originating domain. The notification states "Unknown protocol" as the requestee, leading to user confusion about which site is asking for...

CVE-2018-4252

An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Siri" component. It allows physically proximate attackers to bypass the lock-screen protection mechanism and obtain private notification content via Siri...

Graylog Cross-Site Scripting Vulnerability

Graylog is an open source log storage system , it supports the system log syslog saved to MongoDB distributed document storage database. A cross-site scripting vulnerability exists in notifications in Graylog versions prior to 2.4.4. A remote attacker can exploit this vulnerability to inject...

Apple iOS Siri Permissions Vulnerability (CNVD-2018-12172)

Apple iOS is an operating system developed by Apple Inc. for mobile devices, of which Siri is a voice control component. A security vulnerability exists in the Siri component of Apple iOS prior to version 11.4. An attacker in close physical proximity could use Siri to bypass the lock screen...

Liberapay: CSRF token manipulation in every possible form submits. NO server side Validation

Web Application is generating CSRFtoken values inside cookies which is not a best practice for web applications the revelation of cookies can reveal CSRF Tokens as well. Authenticity tokens should be kept separate from cookies and should be isolated to change operations in the account only...

Liberapay: Unsafe deserialization in Libera Pay allows to escalate a SQL injection to Remote Command Execution

Hello. There isn't a direct vulnerability, however a SQL injection would easily be escalated to a Remote Code Execution. I can't directly exploit it due to the restriction on team names it does not accept hexdecimal values. I, however, submit this issue in advance and will attempt to escalate thi...

CVE-2018-11650

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

Cross site scripting

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

CVE-2018-11650

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

CVE-2018-11650

CVE-2018-11650 affects Graylog before 2.4.4, where unescaped text in notifications (util/UserNotification.js, toastr) enables a cross-site scripting (XSS) vulnerability. The issue arises in the notification output path and can allow injection of HTML/JS in user-facing notifications. Multiple conn...

CVE-2018-11650

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

CVE-2018-11650

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

CVE-2018-11650: Improper Neutralization of Input During Web Page Generation

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

Code injection

Rondaful M1 Wristband Smart Band 1 devices allow remote attackers to send an arbitrary number of call or SMS notifications via crafted Bluetooth Low Energy BLE traffic...

CVE-2018-11631

Rondaful M1 Wristband Smart Band 1 devices allow remote attackers to send an arbitrary number of call or SMS notifications via crafted Bluetooth Low Energy BLE traffic...

CVE-2018-11631: Undefined Security Weakness

Rondaful M1 Wristband Smart Band 1 devices allow remote attackers to send an arbitrary number of call or SMS notifications via crafted Bluetooth Low Energy BLE traffic...

PT-2018-10715

Name of the Vulnerable Software and Affected Versions Rondaful M1 Wristband Smart Band version 1 Description The issue allows remote attackers to send an arbitrary number of call or SMS notifications via crafted Bluetooth Low Energy BLE traffic. Recommendations For Rondaful M1 Wristband Smart Ban...

Windows Defender Firewall: Prohibit notifications

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winadvsecprofilenotification.nasl 10010 2018-05-29 14:43:35Z emoss $ Check value for Windows Defender Firewall: Prohibit notifications Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...