Mozilla: WebExtensions could open arbitrary URLs

The Mozilla Foundation Security Advisory describes this flaw as: A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data...

Mozilla: WebExtensions could open arbitrary URLs

The Mozilla Foundation Security Advisory describes this flaw as: A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data...

Mozilla: WebExtensions could open arbitrary URLs

The Mozilla Foundation Security Advisory describes this flaw as: A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data...

RHEL 8 : thunderbird (RHSA-2023:6195)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6195 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.4.1. Security Fixes: Mozilla:...

RHEL 9 : firefox (RHSA-2023:6199)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6199 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

CVE-2022-3611

An information disclosure vulnerability has been identified in the Lenovo App Store which may allow some applications to gain unauthorized access to sensitive user data used by other unrelated applications...

CVE-2022-3611

An information disclosure vulnerability has been identified in the Lenovo App Store which may allow some applications to gain unauthorized access to sensitive user data used by other unrelated applications...

CVE-2022-3611

Technical details (affected products, versions, root cause, or exploit information) are not publicly available in the provided documents; monitor for updates.

CVE-2022-3611

An information disclosure vulnerability has been identified in the Lenovo App Store which may allow some applications to gain unauthorized access to sensitive user data used by other unrelated applications...

PT-2023-29905 · Stylemixthemes · Stylemixthemes Motors – Car Dealer

Name of the Vulnerable Software and Affected Versions: StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin versions 1.4.6 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into t...

PT-2023-29895 · Unknown · Eric Teubert Archivist – Custom Archive Templates

Name of the Vulnerable Software and Affected Versions: Eric Teubert Archivist – Custom Archive Templates plugin versions 1.7.5 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website...

CVE-2023-39427

In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build 1204.77, the affected applications lack proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code ...

Design/Logic Flaw

In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build 1204.77, the affected applications lack proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code ...

PT-2023-29828 · WordPress · Rednao Woocommerce Pdf Invoice Builder

Name of the Vulnerable Software and Affected Versions: RedNao WooCommerce PDF Invoice Builder plugin versions 1.2.102 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the website,...

PT-2023-29983 · Unknown · Zentao Enterprise Edition

Name of the Vulnerable Software and Affected Versions: ZenTao Enterprise Edition versions 4.1.3 and before Description: The issue is related to Cross Site Scripting XSS, which is a type of attack where an attacker injects malicious scripts into a website, allowing them to steal user data or take...

PT-2023-7352 · Ashlar Vellum · Ashlar-Vellum Graphite

Name of the Vulnerable Software and Affected Versions: Ashlar-Vellum Graphite version 13.0.48 Description: The issue is related to a lack of proper validation of user-supplied data when parsing VC6 files, which could lead to an out-of-bounds read. This may allow an attacker to execute arbitrary...

CVE-2023-42842

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1. An app may be able to access sensitive user data...

CVE-2023-41988

This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sonoma 14.1, watchOS 10.1, iOS 17.1 and iPadOS 17.1. An attacker with physical access may be able to use Siri to access sensitive user data...

CVE-2023-42842

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1. An app may be able to access sensitive user data...

CVE-2023-41982

This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sonoma 14.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1. An attacker with physical access may be able to use Siri to access sensitive user data...