thunderbird: File Extension Spoofing using the Text Direction Override Character

Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This...

thunderbird: File Extension Spoofing using the Text Direction Override Character

Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This...

thunderbird: File Extension Spoofing using the Text Direction Override Character

Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This...

thunderbird: File Extension Spoofing using the Text Direction Override Character

Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This...

Bram Moolenaar, Creator of Vim Text Editor for Linux Passes Away

By Waqas Bram Moolenaar, aged 62, passed away from a medical condition that rapidly progressed over the last few weeks. This is a post from HackRead.com Read the original post: Bram Moolenaar, Creator of Vim Text Editor for Linux Passes Away...

MediaWiki < 1.17.2 Deleted Text Exposure

According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.17.2 or 1.18.x prior to 1.18.1. It is, therefore, affected by a flaw which may allow remote attackers to view deleted text via the prop=revisions parameter. Note that the scanner...

MediaWiki 1.18.x < 1.18.1 Deleted Text Exposure

According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.17.2 or 1.18.x prior to 1.18.1. It is, therefore, affected by a flaw which may allow remote attackers to view deleted text via the prop=revisions parameter. Note that the scanner...

Off By One Error

gpac is vulnerable Off by One errors. The vulnerability is due to the gftextgetutf8line function in loadtext.c, which incorrectly checks for the end of a line when reading a text file, resulting in an application crash...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists because the pull mirror credentials are exposed to the maintainers since they are stored in the plain-text...

CVE-2023-33373

Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use them to impersonate the devices...

CVE-2023-33373

Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use them to impersonate the devices...

CVE-2023-33373

Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use them to impersonate the devices...

Format string

Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use them to impersonate the devices...

Cross-Site Scripting (XSS)

github.com/golang/net is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape user input in text nodes outside the HTML namespace, allowing an attacker to inject and execute malicious JavaScript on a victim's browser...

SUSE CVE-2023-3978

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...

Design/Logic Flaw

Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 model versions 01.49.000 and prior, GT23 model versions 01.49.000 and prior, GT21 model versions 01.49.000 and prior, GOT SIMPLE Series GS25 model versions...

Subscribers Text Counter < 1.7.1 - Settings Update via CSRF to Stored XSS

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping PoC Create an HTML file with the...

PT-2023-24322 · Unknown · Connected Io

Name of the Vulnerable Software and Affected Versions: Connected IO versions 2.1.0 and prior Description: The issue allows attackers to exfiltrate credentials and use them to impersonate devices, as passwords and credentials are kept in clear-text format. Recommendations: For Connected IO version...

Jenkins plugins Multiple Vulnerabilities (2022-06-30)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulti...

CVE-2023-33373

Connected IO CVE-2023-33373 affects v2.1.0 and earlier, where passwords and credentials are stored in clear-text, enabling credential exfiltration and device impersonation. Impact is credential leakage with total compromise potential; exploitation is described conceptually, with no explicit in-wi...