PT-2025-34325 · Npm · Hfs

Summary When adding a "web link" to the HFS virtual filesystem, the frontend opens it with target=" blank" but without the rel="noopener noreferrer" attribute. This allows the opened page to use the window.opener property to change the location of the original HFS tab. Details While most modern...

ABB Busch-Welcome 2 Wire Door Opener Actuator

SUMMARY ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability could gain physical, unauthorized access to a Building where the product is installed 2. MITIGATING FACTORS ABB recommends double check...

CVE-2022-32434

EIPStackGroup OpENer v2.3.0 was discovered to contain a stack overflow via /bin/posix/src/ports/POSIX/OpENer+0x56073d...

CVE-2021-35240

A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'...

CVE-2021-21777

An information disclosure vulnerability exists in the Ethernet/IP UDP handler functionality of EIP Stack Group OpENer 2.3 and development commit 8c73bf3. A specially crafted network request can lead to an out-of-bounds read...

The vulnerability of the xdg-mail utility, a tool for opening email clients, stems from insufficient validation of data entered by users. This allows attackers to influence the integrity of the protected information.

The vulnerability of the xdg-mail tool for opening email clients is related to insufficient validation of the data entered by users. Exploiting this vulnerability allows a remote attacker to influence the integrity of the protected information...

Malicious code in sht-calculator-opener (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51a9f888486fe75f13166070e6c817fc5cfae2087efb4bbb922233178b9381c5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-31477

The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener e.g. xdg-open on Linux. This was...

CVE-2025-25300

CVE-2025-25300 concerns smartbanner.js (pre-1.14.1) where clicking the View link could expose window.opener to a 3rd party page, enabling possible redirection or script manipulation on the original page. The issue is addressed in version 1.14.1 by automatically applying rel="noopener" to links. I...

CVE-2025-25300 smartbanner.js rel noopener XSS vulnerability

smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner View link and navigating to 3rd party page leaves window.opener exposed. It may allow hostile third parties to abuse window.opener, e.g. by redirection or injection on the...

CVE-2022-43605

An out-of-bounds write vulnerability exists in the SetAttributeList attributecountrequest functionality of EIP Stack Group OpENer development commit 58ee13c. A specially crafted EtherNet/IP request can lead to an out of bounds write, potentially causing the server to crash or allow for remote cod...

CVE-2020-13530

A denial-of-service vulnerability exists in the Ethernet/IP server functionality of the EIP Stack Group OpENer 2.3 and development commit 8c73bf3. A large number of network requests in a small span of time can cause the running program to stop. An attacker can send a sequence of requests to trigg...

CVE-2024-9101

A reflected cross-site scripting XSS vulnerability in the 'Entry Chooser' of phpLDAPadmin version 1.2.1 through the latest version, 1.2.6.7 allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' functio...

UBUNTU-CVE-2024-9101

A reflected cross-site scripting XSS vulnerability in the 'Entry Chooser' of phpLDAPadmin version 1.2.1 through the latest version, 1.2.6.7 allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' functio...

PT-2024-39430 · Unknown +1 · Phpldapadmin +1

Name of the Vulnerable Software and Affected Versions: phpLDAPadmin versions 1.2.1 through 1.2.6.7 Description: A reflected cross-site scripting XSS issue in the 'Entry Chooser' of phpLDAPadmin allows attackers to execute arbitrary JavaScript in the user's browser via the element parameter, which...

GHSA-QM5V-PJ64-852J Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab"

Description A user could create and share a resource with a malicious URI. When the victim opens with menu “Open URI in a new tab” function, the malicious page has access to the window.opener object. Impact of issue The newly opened malicious page can for example change the window.opener.location...

PT-2024-40435 · Packagist · Passbolt/Passbolt Api

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned, so the information is not available. Description: A user could create and share a resource with a malicious URI. When the victim opens the URI in a new tab using the "Open URI in a new tab"...

CVE-2024-1569

parisneo/lollms-webui is vulnerable to denial of service through uncontrolled resource consumption. An attacker can trigger repeated unauthenticated POST requests at /open_code_in_vs_code and similar endpoints to repeatedly open VS Code or the default folder opener, exhausting system resources an...

LoLLMs 资源管理错误漏洞

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A resource management error vulnerability exists in LoLLMs that originates from allowing an attacker to open Visual Studio Code or the default folder opener multiple times by sending repeated...

Canada revisits decision to ban Flipper Zero

In February 2024 the Canadian government announced plans to ban the sale of the Flipper Zero, mainly because of its reported use to steal cars. The Flipper Zero is a portable device that can be used in penetration testing with a focus on wireless devices and access control systems. If that doesnt...