2210 matches found
The vulnerability of the Configuration tool for access control and remote authentication in BIG-IP allows a attacker to carry out XSS attacks.
The vulnerability of the Configuration tool for access control and remote authentication in BIG-IP relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...
US Customs and Border Protection Quietly Revokes Protections for Pregnant Women and Infants
CBP’s acting commissioner has rescinded four Biden-era policies that aimed to protect vulnerable people in the agency’s custody, including mothers, infants, and the elderly...
CVE-2025-28062
A Cross-Site Request Forgery CSRF vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections...
CVE-2025-28062
A Cross-Site Request Forgery CSRF vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections...
The vulnerability of the corporate version of the GitHub Enterprise Server, related to the lack of measures taken to protect the website structure, allows attackers to carry out cross-site scripting attacks.
The vulnerability of the corporate version of the GitHub Enterprise Server is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to carry out a cross-site scripting attack remotely...
Amazon Linux 2 : grub2 (ALAS-2025-2844)
The version of grub2 installed on the remote host is prior to 2.06-14. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2844 advisory. When reading the language .mo file in grubmofileopen, grub2 fails to verify an integer overflow when allocating its internal...
New Reports Uncover Jailbreaks, Unsafe Code, and Data Theft Risks in Leading AI Systems
Various generative artificial intelligence GenAI services have been found vulnerable to two types of jailbreak attacks that make it possible to produce illicit or dangerous content. The first of the two techniques, codenamed Inception, instructs an AI tool to imagine a fictitious scenario, which...
AZL-61665 CVE-2025-4035 affecting package libsoup 3.0.4-12
A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set...
CVE-2025-4035 Libsoup: cookie domain validation bypass via uppercase characters in libsoup
A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set...
PT-2025-18149
Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an...
User Profiles: the Achilles' Heel of Web Browsers
Web browsers provide the security foundation for our online experiences. Significant research has been done into the security of browsers themselves, but relatively little investigation has been done into how they interact with the operating system or the file system. In this work, we provide the...
Google Drops Cookie Prompt in Chrome, Adds IP Protection to Incognito
Google on Tuesday revealed that it will no longer offer a standalone prompt for third-party cookies in its Chrome browser as part of its Privacy Sandbox initiative. "We've made the decision to maintain our current approach to offering users third-party cookie choice in Chrome, and will not be...
The vulnerability of Google Chrome’s Custom Tabs component, which allows a hacker to increase their privileges.
The vulnerability of Google Chrome’s Custom Tabs component is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor to enhance their privileges through a specially created application...
The vulnerability of the web interface of the “Central Archive of Medical Images” information system, which stems from the lack of protective measures for the website structure, allows attackers to gain unauthorized access to the protected information.
The vulnerability of the web interface of the “Central Archive of Medical Images” information system is related to the lack of protective measures for the website structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the protected...
Google Chrome 安全漏洞
Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a security bypass vulnerability that originates from an improper implementation in Autofill. An attacker can exploit the vulnerability to bypass security restrictions...
The vulnerability of the WEBGUI component of the SAP NetWeaver Application Server ABAP software integration platform allows a attacker to perform XSS attacks.
The vulnerability of the WEBGUI component of the SAP NetWeaver Application Server ABAP software integration platform exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...
CVE-2025-29766 Tuleap has missing CSRF protections on artifact submission & edition from the tracker view
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap has missing CSRF protections on artifact submission & edition from the tracker view. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up...
CVE-2025-30179 MFA Enforcement Bypass in Search APIs
Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to bypass MFA protections via user search, channel search, or team search queries...
