CVE-2022-30228

A vulnerability has been identified in SICAM GridEdge Classic All versions V2.6.6. The affected software does not apply cross-origin resource sharing CORS restrictions for critical operations. In case an attacker tricks a legitimate user into accessing a special resource a malicious request could...

CVE-2022-30228

CVE-2022-30228 affects Siemens SICAM GridEdge Classic (all versions

CVE-2022-32739

When Secure::DisableBanner system configuration has been disabled and agent shares his calendar via public URL, received ICS file contains OTRS release number...

CVE-2022-32739

CVE-2022-32739 involves OTRS: when Secure::DisableBanner is disabled and an agent shares a calendar via a public URL, the ICS export leaks the OTRS release number. The linked documents explicitly describe the ICS file containing the OTRS release version, linking to multiple advisories and vulnera...

Jira: Multiple Servlet Filter Vulnerabilities

Multiple Servlet Filter vulnerabilities have been fixed in Jira Server and Data Center. These vulnerabilities also affect other Atlassian products. For more information, refer to Atlassian's security...

CVE-2021-27786

Cross-origin resource sharing CORS enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and server to see if the request is allowed. An...

CVE-2021-27786

Cross-origin resource sharing CORS enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and server to see if the request is allowed. An...

Cross site scripting

Cross-origin resource sharing CORS enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and server to see if the request is allowed. An...

New Privacy Framework for IoT Devices Gives Users Control Over Data Sharing

A newly designed privacy-sensitive architecture aims to enable developers to create smart home apps in a manner that addresses data sharing concerns and puts users in control over their personal information. Dubbed Peekaboo by researchers from Carnegie Mellon University, the system "leverages an...

Authorization header leak on port redirect in mechanize

Summary Mechanize rubygem Cookies do not provide isolation by port. If a cookie is readable by a service running on one port, the cookie is also readable by a service running on another port of the same server. If a cookie is writable by a service on one port, the cookie is also writable by a...

CVE-2022-1996

A flaw was found in CORS Filter feature from the go-restful package. When a user inputs a domain which is in AllowedDomains, all domains starting with the same pattern are accepted. This issue could allow an attacker to break the CORS policy by allowing any page to make requests and retrieve data...

Owl Labs Meeting Owl Trust Management Issue Vulnerability

Owl Labs Meeting Owl is a video conferencing device from Owl Labs, Inc. Owl Labs Meeting Owl version 5.2.0.15 is vulnerable to a trust management issue, which could be exploited by an attacker to activate network sharing mode using hard-coded hoothoot credentials via a certain c 150 value...

CVE-2021-27786

CVE-2021-27786 affects HCL Technologies OneTest Server (versions 10.0, 10.1, 10.2). The root cause is a misconfigured HTML5 CORS policy that lacks origin restrictions, allowing requests from arbitrary origins when Access-Control-Allow-Credentials is enabled. Impact stated in sources includes pote...

CVE-2021-27786 HCL OneTest Server is vulnerable to Cross Origin Resource Sharing: Arbitrary Origin Trusted

Cross-origin resource sharing CORS enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and server to see if the request is allowed. An...

CVE-2021-27786

Cross-origin resource sharing CORS enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and server to see if the request is allowed. An...

CVE-2022-26497

BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor could have a username containing a JavaScript payload. The payload gets executed in the browser of the victim in the "Share room access" dialog if the victim has shared access to the particular room with the attacker previously...

Owl Labs Meeting Owl 信任管理问题漏洞

Owl Labs Meeting Owl is a video conferencing device from Owl Labs, Inc. Owl Labs Meeting Owl version 5.2.0.15 is vulnerable to a trust management issue, which could be exploited by an attacker to activate network sharing mode using hard-coded hoothoot credentials via a certain c 150 value...

BigBlueButton 安全漏洞

BigBlueButton is an open source Web conferencing system from the BigBlueButton community.BigBlueButton is vulnerable to an information disclosure vulnerability that could be exploited by an attacker to find information related to an external video being shared...

Use-After-Free

chromium is vulnerable to use-after-free. The vulnerability exists in in Sharing which allows an attacker to cause a memory corruption leading to an application crash...

The vulnerability of the Sharing component in Google Chrome allows a hacker to execute arbitrary code.

The vulnerability of Google Chrome’s Sharing component is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created web page from a remote location...