Johnny-You-Are-Fired

Johnny-You-Are-Fired Artefatos da publicação USENIX | Artigo completo aqui Resumo OpenPGP e S/MIME são os dois principais padrões para criptografar e assinar digitalmente e-mails. As assinaturas digitais devem garantir a autenticidade e a integridade das mensagens. Neste trabalho, mostramos ataqu...

CVE-2023-38873-G1

🚨 G1 = A05:2021 – Security Misconfiguration ClickJacking ⚠️ Pontuação base: 6.5 MÉDIO Escala: CVSS ⚠️ 📌 Descrição Este repositório demonstra uma falha de segurança do tipo Clickjacking presente no site do G1. A vulnerabilidade permite que um invasor carregue o site dentro de um iframe , sobrepondo...

CVE-2026-74951

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Clickjacking issue in Firefox for Android...

UBUNTU-CVE-2026-74951

Clickjacking issue in Firefox for Android. This vulnerability was fixe...

UBUNTU-CVE-2026-74975

Spoofing issue in the Downloads component in Firefox for Android. This...

CVE-2026-74951

Clickjacking issue in Firefox for Android. This vulnerability was fixe...

CVE-2026-18534 Address bar spoofing risk in affected iOS versions of Arc Search

ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk...

CVE-2026-74980

A clickjacking flaw in Firefox for Android's Downloads component allows a malicious page to trick users into unintended downloads. CVSS 6.5 (MEDIUM), network-accessible with user interaction. Fixed in Firefox 154; the Nessus plugin confirms no in-the-wild exploitation is known.

CVE-2026-74980

Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...

CVE-2026-74978

Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

PT-2026-77008

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 154 Description A spoofing issue exists within the Downloads component, which could allow an attacker to deceive users by misrepresenting the source or nature of a downloaded file. Recommendations Update t...

PT-2026-77013

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 154 Description A clickjacking issue exists in the Downloads component. Clickjacking is a technique where an attacker uses multiple transparent or semi-transparent layers to trick a user into clicking on a...

CVE-2026-44767 Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection

setThemeRoot failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a element, even when no tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL...

CVE-2026-33406

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js,...

CVE-2026-33406

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js,...

CVE-2026-33406 Pi-hole has a Stored HTML attribute injection

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js,...

CVE-2026-31873

Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe safe.ts uses String.includes, which is case-sensitive. Browsers treat URI schemes case-insensitively. DATA:text/css,... is the same as data:text/css,... to the browser, but 'DATA:...'.includes'data...

CVE-2026-31873

Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe safe.ts uses String.includes, which is case-sensitive. Browsers treat URI schemes case-insensitively. DATA:text/css,... is the same as data:text/css,... to the browser, but 'DATA:...'.includes'data...

CVE-2025-70296

A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary HTML, resulting in user interface redressing within the recipe view...

CVE-2025-70296

A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary HTML, resulting in user interface redressing within the recipe view...