Medium: kernel

Issue Overview: A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol L2TP. A missing lock when clearing skuserdata can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system causing a denial of service. CVE-2022-4129 A...

The vulnerabilities of Mozilla Firefox, Mozilla Firefox ESR, and the email client Mozilla Thunderbird involve information representation errors in the user interface, allowing attackers to force the browser into full-screen mode.

The vulnerabilities of Mozilla Firefox, Mozilla Firefox ESR, and the email client Mozilla Thunderbird are related to information representation errors in the user interface. Exploiting these vulnerabilities can allow a malicious actor to force the browser into full-screen mode remotely...

Mozilla Firefox Code Problem Vulnerability (CNVD-2023-68213)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a code issue vulnerability that stems from the fact that by displaying a prompt with a long description, a full-screen notification may be hidden, which can be exploited by...

The vulnerability in the full-screen mode of the Mozilla Firefox browser, which allows a hacker to execute a spoofing attack

The vulnerability of the full-screen mode of the Mozilla Firefox browser is related to insufficient warnings about dangerous actions. Exploiting this vulnerability allows a remote attacker to carry out spoofing attacks...

Malicious code in react-screen-reader-announce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc94449e1dfbaea67fc7604cd192d90a355930f498364278937ae27e64050540 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-734 Malicious code in react-screen-reader-announce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc94449e1dfbaea67fc7604cd192d90a355930f498364278937ae27e64050540 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security fix for the ALT Linux 10 package firefox-esr version 102.8.0-alt1

102.8.0-alt1 built March 15, 2023 Pavel Vasenkov in task 316239 March 3, 2023 Pavel Vasenkov - New ESR version. - Security fixes + CVE-2023-25728 Content security policy leak in violation reports using iframes + CVE-2023-25730 Screen hijack via browser fullscreen mode + CVE-2023-0767 Arbitrary...

CVE-2023-27895

SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The attacker could extract the currently views of the OTP and the secret OTP alphanumeric token during the token setup. On successful...

CVE-2023-27895

SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The attacker could extract the currently views of the OTP and the secret OTP alphanumeric token during the token setup. On successful...

Code injection

SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The attacker could extract the currently views of the OTP and the secret OTP alphanumeric token during the token setup. On successful...

CVE-2023-27895 Information Disclosure vulnerability in SAP Authenticator for Android

SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The attacker could extract the currently views of the OTP and the secret OTP alphanumeric token during the token setup. On successful...

CVE-2023-27895

SAP Authenticator for Android (version 1.3.0) is reported to expose OTP-related data when a malicious app is installed on a device, allowing screen capture during token setup. The attacker could read the currently viewed OTP and the secret OTP alphanumeric token, but cannot modify or delete data....

[SECURITY] Fedora 38 Update: wf-recorder-0.3.1-0.3.20221225gita9725f7.fc38

wf-recorder is a utility program for screen recording of wlroots-based compositors more specifically, those that support wlr-screencopy-v1 and xdg-output...

SAP Authenticator 安全漏洞

SAP Authenticator is a mobile application from SAP that generates passwords for systems that require one-time password authentication. A security vulnerability exists in SAP Authenticator version 1.3.0, which originated from allowing an authorized attacker to install a malicious application on a...

CVE-2023-27895: Privilege Defined With Unsafe Actions

SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The attacker could extract the currently views of the OTP and the secret OTP alphanumeric token during the token setup. On successful...

Malicious Package

Overview react-screen-reader-announce is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...

Spoofing Attacks

Google Chrome is vulnerable to Spoofing Attacks. The vulnerability exists due to the inappropriate implementation in Full-screen mode, which allows an attacker to spoof the contents of the security UI via a crafted HTML page...

Security fix for the ALT Linux 10 package thunderbird version 102.8.0-alt1

102.8.0-alt1 built March 10, 2023 Pavel Vasenkov in task 316084 Feb. 28, 2023 Pavel Vasenkov - New version. - Security fixes: + CVE-2023-0616 User Interface lockup with messages combining S/MIME and OpenPGP + CVE-2023-25728 Content security policy leak in violation reports using iframes +...

Debian: Security Advisory (DLA-305-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Citrix PVS target device BSODs upon installing Zscaler client.

Installing the Zscaler client on Citrix PVS target device causes a blue screen of death. Target device crashes with exception code 7e caused by access violation of Citrix Virtual Hard Disk driver,CVhdMp.sys...