Mozilla: frame-ancestors Content Security Policy directive was not enforced for framed extension pages

The Mozilla Foundation Security Advisory describes this flaw as: Web-accessible extension pages pages with a moz-extension:// scheme were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy...

Cross-site Scripting (XSS) - Stored in librenms/librenms

Description Stored XSS in create/modify Transport Groups, Add/Edit Service and Edit Service Template Proof of Concept Payload: ' PoC image: Xss payload in create/modify Transport Groups Xss payload in Add/Edit Service Xss payload in Edit Service Template XSS will fire-up by user visiting: 1...

Cross-site Scripting (XSS) - Generic in librenms/librenms

Description Cross-Site Scripting vulnerability in LibreNMS v22.1.0 which allows attackers to execute arbitrary javascript code which affected Alerts module Alert Transport in Transport name field. Proof of Concept Endpoint: 1 POST http://HOST/ajaxform.php - Parameter name Payload: ' XSS will...

Google Chrome Security Feature Issue Vulnerability (CNVD-2022-45561)

Google Chrome is a web browser from Google Inc. A security feature vulnerability exists in Google Chrome that could be exploited to convince users to install malicious extensions and perform sandbox escapes via carefully designed HTML pages...

GHSA-VP4X-94FF-2CMV Cross-site scripting in forkcms

Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the "navigationtitle" parameter and the "title" parameter in /private/en/pages/add...

Nextcloud: Information Exposure Through Directory Listing vulnerability

A directory listing provides an attacker with the complete index of all the resources located inside of the directory as well as download or access its contents. While the researcher did not dig deeper on to the available files, it might be possible that these websites host sensitive information...

Google Chrome Security Feature Issue Vulnerability (CNVD-2022-45570)

Google Chrome is a web browser from Google, Inc. A security feature vulnerability exists in versions of Google Chrome prior to 98.0.4758.80, which can be exploited by remote attackers to compromise cross-domain data via crafted HTML pages...

Google Chrome Type Obfuscation Vulnerability (CNVD-2022-45565)

Google Chrome is a web browser from Google, Inc. A type obfuscation vulnerability exists in Google Chrome, which can be exploited by remote attackers to potentially exploit heap corruption via well-designed HTML pages...

Google Chrome Buffer Overflow Vulnerability (CNVD-2022-45562)

Google Chrome is a web browser from Google, Inc. A buffer overflow vulnerability exists in Google Chrome, which can be exploited by remote attackers to potentially exploit heap corruption via well-designed HTML pages...

The vulnerability of the KVM kernel virtualization subsystem in Linux operating systems, related to deficiencies in access control, allows attackers to escalate their privileges.

The vulnerability of the KVM kernel virtualization subsystem in the Linux operating system is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges and read/write physical pages on the host...

Mozilla Firefox 安全特征问题漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation. A security signature issue vulnerability exists in Mozilla Firefox, which arises from a product framework root content security policy directive that does not restrict framework extension pages. A remote attacker could use...

Roaming Mantis reaches Europe

Roaming Mantis is a malicious campaign that targets Android devices and spreads mobile malware via smishing. We have been tracking Roaming Mantis since 2018, and published five blog posts about this campaign: Roaming Mantis uses DNS hijacking to infect Android smartphones Roaming Mantis dabbles i...

The vulnerability of PDF files created by AcroForms, a text viewing program called Foxit Reader, and the PDF editing program Foxit PhantomPDF, allowing attackers to disclose protected information.

The vulnerability of PDF files created by AcroForms, as well as the Foxit Reader and Foxit PhantomPDF programs used for PDF editing, is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

The vulnerability of objects in the Foxit Reader text viewer and Foxit PhantomPDF PDF editing programs allows a perpetrator to execute arbitrary code.

The vulnerability of objects in the Foxit Reader text viewer and Foxit PhantomPDF PDF editing programs relates to the execution of operations outside of the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created malicious web...

CVE-2021-29395

Directory travesal in /northstar/filemanager/download.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to download arbitrary files, including JSP source code, across the filesystem of the host of the web application...

Schneider Electric EcoStruxure Power Monitoring Expert 跨站脚本漏洞

The Schneider Electric EcoStruxure Power Monitoring Expert is a device from Schneider Electric, France, for power distribution monitoring in IoT environments. The Schneider Electric EcoStruxure Power Monitoring Expert suffers from a cross-site scripting vulnerability that stems from an incorrect...

Northstar Club Management 路径遍历漏洞

Northstar Club Management is a web-based solution from Northstar, Inc. that allows organizations to manage all elements of a club, such as memberships, guests, events, and more. A path traversal vulnerability exists in Northstar Club Management version 6.3, which stems from the software's lack of...

Important: Red Hat Security Advisory: varnish:6 security update

An update for the varnish:6 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

PT-2022-6482 · Zabbix +2 · Zabbix +2

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The issue is related to the lack of protection of the web page structure in Zabbix. An authenticated user can create a link with reflected Javascript code inside it for the services' page an...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS which can lead to cookie stealing of any victim that visits the affected URL so the attacker can gain unauthorized access to that user's account through the stolen cookie. PoC php 1. Login as Admin 2. Go to Syst...