CVE-2024-32477 Race condition when flushing input stream leads to permission prompt bypass

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. By using ANSI escape sequences and a race between libc::tcflush0, libc::TCIFLUSH and reading standard input, it's possible to manipulate the permission prompt and force it to allow an unsafe action regardless of the...

CVE-2024-32477

The CVE-2024-32477 vulnerability affects Deno versions prior to 1.42.2, caused by a race between ANSI escape sequences (e.g., ) and reading standard input. This allows an attacker to manipulate the permission prompt and bypass the permission policy via the PTY channel. Several connected sourc...

CVE-2024-32477 Race condition when flushing input stream leads to permission prompt bypass

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. By using ANSI escape sequences and a race between libc::tcflush0, libc::TCIFLUSH and reading standard input, it's possible to manipulate the permission prompt and force it to allow an unsafe action regardless of the...

Mozilla: Permission prompt input delay could expire when not in focus

The Mozilla Foundation Security Advisory describes this flaw as: The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites...

Mozilla: Permission prompt input delay could expire when not in focus

The Mozilla Foundation Security Advisory describes this flaw as: The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites...

Mozilla: Permission prompt input delay could expire when not in focus

The Mozilla Foundation Security Advisory describes this flaw as: The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites...

Mozilla: Permission prompt input delay could expire when not in focus

The Mozilla Foundation Security Advisory describes this flaw as: The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites...

Mozilla: Permission prompt input delay could expire when not in focus

The Mozilla Foundation Security Advisory describes this flaw as: The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites...

CVE-2024-2609

The Mozilla Foundation Security Advisory describes this flaw as: The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites...

Mozilla: Permission prompt input delay could expire when not in focus

The Mozilla Foundation Security Advisory describes this flaw as: The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites...

Mozilla: Permission prompt input delay could expire when not in focus

The Mozilla Foundation Security Advisory describes this flaw as: The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites...

Mozilla: Permission prompt input delay could expire when not in focus

The Mozilla Foundation Security Advisory describes this flaw as: The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites...

Mozilla: Permission prompt input delay could expire when not in focus

The Mozilla Foundation Security Advisory describes this flaw as: The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites...

RHEL 9 : firefox (RHSA-2024:1905)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1905 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

RHEL 9 : firefox (RHSA-2024:1907)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1907 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

RHEL 7 : firefox (RHSA-2024:1910)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1910 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

RHEL 8 : firefox (RHSA-2024:1906)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1906 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

RHEL 8 : firefox (RHSA-2024:1911)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1911 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

GHSA-C9H6-V78W-52WJ Keycloak vulnerable to session hijacking via re-authentication

A flaw was found in Keycloak. An active keycloak session can be hijacked by initiating a new authentication having the query parameter prompt=login and forcing the user to enter his credentials once again. If the user cancels this re-authentication by clicking Restart login, the account takeover...

keycloak: session hijacking via re-authentication

A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter "prompt=login," prompting the user to re-enter...