PT-2022-22248 · Mealie · Mealie

Name of the Vulnerable Software and Affected Versions: Mealie version 0.5.5 Description: A stored cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Shopping Lists item names text field. This enables attackers t...

New DawDropper Malware Targeting Android Devices via Play Store

By Waqas According to Trend Micro researchers, the DawDropper aims at stealing user data, in particular from banking apps on… This is a post from HackRead.com Read the original post: New DawDropper Malware Targeting Android Devices via Play Store...

A Retrospective on the 2015 Ashley Madison Breach

Its been seven years since the online cheating site AshleyMadison.com was hacked and highly sensitive data about its users posted online. The leak led to the public shaming and extortion of many Ashley Madison users, and to at least two suicides. To date, little is publicly known about the...

Mozilla Firefox 竞争条件问题漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox, which stems from insufficient cleaning of user-supplied data, and can be exploited by remote attackers to execute arbitrary HTML and script code in a...

CVE-2022-35652

An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful exploitation of this...

CVE-2022-26306

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which...

PT-2022-15769 · Western Digital · Western Digital My Cloud

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud devices affected versions not specified Description: The issue allows a malicious user with elevated privileges to construct and inject JavaScript payloads into an authenticated user's browser, potentially gaining...

Apple iOS and iPadOS Input Validation Error Vulnerability

Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for the iPad tablet computer. An input validation error vulnerability exists in Apple iOS before 15.6 and iPadOS before 15.6, which stems fr...

Apple macOS Big Sur 安全特征问题漏洞

Apple macOS Big Sur and Apple macOS Monterey are both products of Apple Inc.Apple macOS Big Sur is the 17th major release of macOS, Apple's operating system for the MAC.Apple macOS Monterey is the the 18th major release of macOS for the Macintosh desktop operating system macOS. Apple macOS Big Su...

PT-2022-21547 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.5 Description: The issue allows an app to potentially access user-sensitive data. It was addressed by enabling hardened runtime. Recommendations: For versions prior to 12.5, update to macOS Monterey 12.5 to resolve...

PT-2022-8902 · Npm · Markdown-It-Decorate

Name of the Vulnerable Software and Affected Versions: markdown-it-decorate versions prior to a fixed version no fixed version available Description: The issue affects the markdown-it-decorate package, allowing an attacker to add an event handler or use javascript:xxx for the link, potentially...

Microsoft Details App Sandbox Escape Bug Impacting Apple iOS, iPadOS, macOS Devices

Microsoft on Wednesday shed light on a now patched security vulnerability affecting Apple's operating systems that, if successfully exploited, could allow attackers to escalate device privileges and deploy malware. "An attacker could take advantage of this sandbox escape vulnerability to gain...

OPENSUSE-SU-2022:1157-1 Security update for libsolv, libzypp, zypper

This update for libsolv, libzypp, zypper fixes the following issues: Security relevant fix: - Harden package signature checks bsc1184501. libsolv update to 0.7.22: - reworked choice rule generation to cover more usecases - support SOLVABLEPREREQIGNOREINST in the ordering code bsc1196514 - support...

Uncovering a macOS App Sandbox escape vulnerability: A deep dive into CVE-2022-26706

Microsoft uncovered a vulnerability in macOS that could allow specially crafted codes to escape the App Sandbox and run unrestricted on the system. We shared these findings with Apple through Coordinated Vulnerability Disclosure CVD via Microsoft Security Vulnerability Research MSVR in October...

IBM i 跨站脚本漏洞

IBM i is a set of operating systems from IBM running in IBM Power Systems and IBM PureSystems. IBM i versions 7.2, 7.3, 7.4, and 7.5 have a cross-site scripting vulnerability that stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could exploi...

WebView2-Cookie-Stealer - Attacking With WebView2 Applications

Please read this blog post to get more information. Source Code This code is a modified version of Microsoft's WebView2 Code. The current code can be cleaned up and made much better. Demo Launch Example Usage Example Usage Tested onWindows 10 & 11. When the binary is executed...

CVE-2022-1955

Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possible due to lack of adequate security controls to prevent dynamic code manipulation...

IBM CICS TX Advanced Cross-Site Scripting Vulnerability

IBM CICS TX Advanced is a comprehensive, single transaction runtime package from IBM USA. It can provide a cloud-native deployment model for standalone applications. A cross-site scripting vulnerability exists in all versions of IBM CICS TX Advanced, which stems from the program's lack of data...

TikTok Assures U.S. Lawmakers it's Working to Safeguard User Data From Chinese Staff

Following heightened worries that U.S. users' data had been accessed by TikTok engineers in China between September 2021 and January 2022, the company sought to assuage U.S. lawmakers that it's taking steps to "strengthen data security." The admission that some China-based employees can access...

GHSA-5M48-C37X-F792 Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data

In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the tagName property of an Ember.View was inserted into such a string without being sanitized. This means that if an application assigns a view's tagName to...