CVE-2021-20733

Improper authorization in handler for custom URL scheme vulnerability in あすけんダイエット asken diet for Android versions from v.3.0.0 to v.4.2.x allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App...

Authorization

Improper authorization in handler for custom URL scheme vulnerability in ????????? asken diet for Android versions from v.3.0.0 to v.4.2.x allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App...

CVE-2021-20733

Improper authorization in handler for custom URL scheme vulnerability in あすけんダイエット asken diet for Android versions from v.3.0.0 to v.4.2.x allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App...

CVE-2021-20733

Improper authorization in handler for custom URL scheme vulnerability in あすけんダイエット asken diet for Android versions from v.3.0.0 to v.4.2.x allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App...

CVE-2021-20733

CVE-2021-20733 concerns Asken Diet (Android) where improper authorization in the handler for a custom URL scheme allows a remote attacker to steer a user to an arbitrary website via the vulnerable app. Affected versions are v3.0.0 through v4.2.x. The root cause is insufficient access control arou...

CVE-2021-20733: Missing Authorization

Improper authorization in handler for custom URL scheme vulnerability in あすけんダイエット asken diet for Android versions from v.3.0.0 to v.4.2.x allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App...

PT-2021-14189 · あすけんダイエット · あすけんダイエット

Name of the Vulnerable Software and Affected Versions: あすけんダイエット asken diet versions 3.0.0 through 4.2.x Description: The issue is related to improper authorization in the handler for a custom URL scheme, allowing a remote attacker to lead a user to access an arbitrary website via the vulnerable...

Cross-site Scripting (XSS) - Stored in thoughtbot/administrate

💥 BUG Stored xss using unsanitize url 💥 IMPACT There is no url scheme sanitization, allow to provide javascript protocol in url which cause xss 💥 PAYLOAD javascript:alertdocument.domain 💥 STEP TO REPRODUCE tested in demo version https://administrate-demo.herokuapp.com/admin.\ 1. Plz check this 1...

Andariel evolves to target South Korea with ransomware

Executive summary In April 2021, we observed a suspicious Word document with a Korean file name and decoy. It revealed a novel infection scheme and an unfamiliar payload. While we were doing our research into these findings, Malwarebytes published a nice report with technical details about the sa...

JVN#38034268: あすけん App for Android fails to restrict custom URL schemes properly

あすけん App for Android by asken Inc. provides the function to access a requested URL using Custom URL Scheme. The App does not restrict access to the function properly CWE-939 which may be exploited to direct the App to access any sites. Impact A remote attacker may lead a user to access an arbitra...

CVE-2021-33359

A vulnerability exists in gowitness 2.3.6 that allows an unauthenticated attacker to perform an arbitrary file read using the file:// scheme in the url parameter to get an image of any file...

CVE-2021-33359

A vulnerability exists in gowitness 2.3.6 that allows an unauthenticated attacker to perform an arbitrary file read using the file:// scheme in the url parameter to get an image of any file...

CVE-2021-33359

A vulnerability exists in gowitness 2.3.6 that allows an unauthenticated attacker to perform an arbitrary file read using the file:// scheme in the url parameter to get an image of any file...

sensepost gowitness 授权问题漏洞

gowitness is a website screenshot utility program written in Golang. An authorization issue vulnerability exists in sensepost gowitness that stems from a lack of authentication measures in gowitness. Exploitation of this vulnerability allows an unauthenticated attacker to perform arbitrary file...

PT-2021-20127

Name of the Vulnerable Software and Affected Versions gowitness versions prior to 2.3.6 Description A vulnerability exists that allows an unauthenticated attacker to perform an arbitrary file read using the file:// scheme in the url parameter to get an image of any file. Recommendations For...

CVE-2021-33359: Files or Directories Accessible to External Parties

A vulnerability exists in gowitness 2.3.6 that allows an unauthenticated attacker to perform an arbitrary file read using the file:// scheme in the url parameter to get an image of any file...

Jira Server and Jira Data Center 跨站脚本漏洞

Atlassian JIRA Server and Jira Server & Data Center are both products of Atlassian Australia.Atlassian JIRA Server is the server version of a defect tracking management system. The system is mainly used for tracking and managing all kinds of problems and defects in the workplace.Jira Server & Dat...

USN-4981-1 squid, squid3 vulnerabilities

Joshua Rogers discovered that Squid incorrectly handled requests with the urn: scheme. A remote attacker could possibly use this issue to cause Squid to consume resources, leading to a denial of service. CVE-2021-28651 Joshua Rogers discovered that Squid incorrectly handled requests to the Cache...

DoJ Charges Rhode Island Woman in Phishing Scheme Against Politicians

The Department of Justice DoJ has charged a woman in Rhode Island in a phishing campaign against candidates for political office and related associates that impersonated various individuals–including campaign workers and the Microsoft security team—in an attempt to trick victims into providing...

JVN#91691168: goo blog App fails to restrict custom URL schemes properly

goo blog App by NTT Resonant Incorporated provides the function to access a requested URL using Custom URL Scheme. The App does not restrict access to the function properly CWE-284 which may be exploited to direct the App to access any sites. Impact A remote attacker may lead a user to access an...