2782 matches found
Mozilla Firefox/Firefox ESR Command Injection Vulnerability
Mozilla Firefox is a free, open-source browser for Windows, Linux, and MacOSX. firefox ESR refers to the Extended Support Release of Firefox, which was created by mozilla specifically for organizations that can't or don't want to upgrade their browser every six weeks. A command injection...
UBUNTU-CVE-2020-6811
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as Curl' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command...
CVE-2020-6805
The Mozilla Foundation Security Advisory describes this flaw as: When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable crash...
Unspecified Vulnerability in JetBrains TeamCity (CNVD-2020-27796)
JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A security vulnerability exists in JetBrains...
Jama Connect Cross-Site Scripting Vulnerability
Jama Connect is an application lifecycle management product that can be deployed in the cloud or installed on Mac and Windows devices. A cross-site scripting vulnerability exists in Jama Connect 8.44.0. The vulnerability can be exploited to conduct a cross-site scripting attack via the Select...
Office Product Key Finder 1.5.4 - Denial of Service (PoC)
Office Product Key Finder 1.5.4 - Denial of Service PoC Exploit Title: Office Product Key Finder 1.5.4 - Denial of Service PoC Date: 2020-01-06 Vendor Homepage: http://www.nsauditor.com/ Software Link: http://www.nsauditor.com/downloads/officeproductkeyfindersetup.exe Exploit Author: Gokkul Teste...
CVE-2019-11693
The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. Note: this issue only occurs on Linux. Other operating systems are unaffected.. This...
Phabricator: Markdown parsing issue enables insertion of malicious tags
mongoose By exploiting the URL markdown an attacker is able to add tags to an anchor-element. This is less impactfull since the default csp policy blocks inline javascript execution, but an attacker could deface individual pages, bypass the rel="norefferrer" tag to perform tab nabbing or perform...
The vulnerability of Google Chrome arises from insufficient validation of input data, allowing a hacker to replace the user’s interface in the “Extensions” tab.
The vulnerability of Google Chrome exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to replace the user interface in the “Extensions” tab using a specially created HTML page...
A vulnerability in the functionality of website isolation occurs during the restoration of tabs and the Google Chrome browser, allowing a intruder to gain unauthorized access to protected information.
The vulnerability in the isolation function of websites, which occurs during the restoration of tabs and the Google Chrome browser, is related to authentication errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
High-Severity Windows UAC Flaw Enables Privilege Escalation
Researchers disclosed details of a high-severity Microsoft Windows vulnerability that could give attackers elevated privileges – ultimately allowing them to install programs, and view, change or delete data. The bug stems from User Account Control UAC, a security feature of Windows within Secure...
Asset Discover - Burp Suite Extension To Discover Assets From HTTP Response
Burp Suite extension to discover assets from HTTP response using passive scanning. Refer our blog Asset Discovery using Burp Suite for more details. The extension is now part of the BApp store and can be installed directly from the Burp Suite...
The vulnerability of Firefox browsers, caused by display errors in file names in the “Downloads” tab, allows attackers to perform spear-phishing attacks.
The vulnerability of Firefox browsers arises due to errors in the character display in file names within the “Downloads” tab. Exploiting this vulnerability allows a remote attacker to perform spear-phishing attacks...
How to select by default Apps instead of Favorites tab on RfWebUI Theme
Unified Gateway ICA Proxy set to NO without Storefront will land on the Favorites page. Default: Goal:...
New Relic: Stored XSS at Mobile (Versions tab)
Hey team, I've discovered stored XSS rendered at Mobile inside the Versions tab working at least at latest Safari and latest Chrome MacOS. Steps to reproduce: 1 Sign into Mobile with some account which can edit the mobile applications 2 Navigate to some active mobile app, then go to Settings -...
CVE-2019-17045
Ilch 2.1.22 allows stored XSS via the title, text, or email id to the Jobs Tab...
CVE-2019-17045
Ilch 2.1.22 allows stored XSS via the title, text, or email id to the Jobs Tab...
Cross site scripting
Ilch 2.1.22 allows stored XSS via the title, text, or email id to the Jobs Tab...
CVE-2019-17045
The CVE-2019-17045 entry concerns Ilch CMS 2.1.22 with a stored XSS in the Jobs Tab, exploitable via the title, text, or email id fields. Root cause cited by CNVD-2019-42862 is lack of proper validation of client-side data. Consequences include execution of client-side code in authenticated conte...
