CVE-2021-40835 URL Address Bar Spoofing in F-Secure SAFE Browser for iOS

An URL Address bar spoofing vulnerability was discovered in Safe Browser for iOS. When user clicks on a specially crafted a malicious URL, if user does not carefully pay attention to url, user may be tricked to think content may be coming from a valid domain, while it comes from another. This is...

CVE-2021-40835

CVE-2021-40835 affects F-Secure Safe Browser for iOS. The issue is an URL address bar spoofing vulnerability where a specially crafted URL with an extremely long username part can mislead users into thinking content comes from a valid domain. The described root cause is that the username portion ...

F-Secure Safe Browser 安全漏洞

F-Secure Safe Browser is an Internet security browser from the Finnish company F-Secure. It is used to block viruses, Trojans, ransomware and other threats in real time. A security vulnerability exists in F-Secure Safe Browser for iOS that stems from a URL address bar spoofing vulnerability...

Backdoor.Win32.Nucleroot.mf Buffer Overflow

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/8de56eef118187a89eeab972288ce94d.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Nucleroot.mf Vulnerability: Stack Buffer Overflow Description: Description: MaskPE by...

Backdoor.Win32.Ncx.b Buffer Overflow

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/991c1f02c809cee860cb712896a45338B.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Ncx.b Vulnerability: Remote Stack Buffer Overflow Description: The malware listens o...

Prototype polluation in just-safe-set

Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution...

GHSA-V26W-GCXH-V4R7 Prototype polluation in just-safe-set

Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution...

fusion-plugin-jwt (>=0.1.0, <=0.1.8), toystore (>=1.1.1, <=1.5.3) potentially affected by CVE-2021-25952 via just-safe-set (1.1.0)

just-safe-set NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on just-safe-set and may be impacted: - fusion-plugin-jwt =0.1.0, =1.1.1, =1.5.3 Source cves: CVE-2021-25952 Source advisory: OSV:GHSA-V26W-GCXH-V4R7...

CVE-2021-40834

A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a specially crafted seemingly legitimate URL SAFE browser goes into full screen and hides the user interface. A remote attacker can leverage this to perform spoofing attack...

CVE-2021-40834

A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a specially crafted seemingly legitimate URL SAFE browser goes into full screen and hides the user interface. A remote attacker can leverage this to perform spoofing attack...

Input validation

A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a specially crafted seemingly legitimate URL SAFE browser goes into full screen and hides the user interface. A remote attacker can leverage this to perform spoofing attack...

CVE-2021-40834 User interface Spoofing in F-Secure SAFE browser for Android

A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a specially crafted seemingly legitimate URL SAFE browser goes into full screen and hides the user interface. A remote attacker can leverage this to perform spoofing attack...

CVE-2021-40834

CVE-2021-40834 is an UI overlay vulnerability in F‑Secure SAFE Browser for Android. A specially crafted URL can cause the browser to go full screen and hide the user interface, enabling a spoofing attack by a remote attacker. Documented impact is spoofing; CVSS v3.1 vector indicates Network attac...

F-Secure Safe Browser 安全漏洞

F-Secure Safe Browser is an Internet security browser from the Finnish company F-Secure. It is used to block viruses, Trojans, ransomware and other threats in real time. A security vulnerability exists in F-secure SAFE Browser for Android, which stems from the SAFE Browser going full-screen and...

_swapExactOutputSingle() and _swapExactOutputMultihop() May Fail When Transfer Token to recipient

Handle Meta0xNull Vulnerability details Impact IERC20input.safeTransferFromaddressthis, recipient, options.limitAmount - amountIn; For safeTransferFrom to work it needs to have an enough approval. In this case, obviously this contract does not approve every recipient when Transfer Token, so we ca...

Backdoor.Win32.BlueAdept.02.a Buffer Overflow

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/694d21679cc212c59515584d1b65dc84.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.BlueAdept.02.a Vulnerability: Remote Buffer Overflow Description: The malware listens...

Why I Hate Password Rules

The other day, I was creating a new account on the web. It was financial in nature, which means it gets one of my most secure passwords. I used Password Safe to generate this 16-character alphanumeric password: :s^Twd.J;3hzg=Q Which was rejected by the site, because it didnt meet its password...

openssl security and bug fix update

1:1.1.1k-4 - Fixes bugs in s390x AES code. - Uses the first detected address family if IPv6 is not available - Reverts the changes in https://github.com/openssl/openssl/pull/13305 as it introduces a regression if server has a DSA key pair, the handshake fails when the protocol is not explicitly s...

UVI-2021-1002106 blk-cgroup: blk_cgroup_bio_start() should use irq-safe operations on blkg->iostat_cpu

blk-cgroup: blkcgroupbiostart should use irq-safe operations on blkg-iostatcpu This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.14.15 by commi...

GHSA-3RCW-9P9X-582V Code injection in `saved_model_cli`

Impact TensorFlow's savedmodelcli tool is vulnerable to a code injection as it calls eval on user supplied strings python def preprocessinputexprsargstringinputexprsstr: ... for inputraw in filterbool, inputexprsstr.split';': ... inputkey, expr = inputraw.split'=', 1 inputdictinputkey = evalexpr...