CVE-2021-42841

Insta HMS before 12.4.10 is vulnerable to XSS because of improper validation of user-supplied input by multiple scripts. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the U...

WPLegalPages < 2.7.1 - Subscriber+ Arbitrary Settings Update to Stored XSS

The plugin does not check for authorisation and has a flawed CSRF logic when saving its settings, allowing any authenticated users, such as subscriber, to update them. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored Cross-Site Scripting Run the below command in...

CVE-2022-21649

Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "" but escaping for double quotes does not exist. Through this...

Cross site scripting

Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "" but escaping for double quotes does not exist. Through this...

CVE-2022-21649 Stored XSS via attribute in convos

Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "" but escaping for double quotes does not exist. Through this...

CVE-2022-21650

CVE-2022-21650 describes a stored XSS in Convos, caused by filtering bypass for file uploads: an SVG file uploaded with an .html extension bypasses the upload filter, allowing stored XSS that triggers when a user views the file. The vulnerability affects the Convos web-based chat application and ...

Cross-site Scripting (XSS) - Stored in convos-chat/convos

Description The Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "" but escaping for double quarter does not exist. Proof ...

Cross-site Scripting (XSS) - Stored in star7th/showdoc

Description Stored XSS via upload attachment with format .svg in File Library. Detail When opening the attachment, some format files will be rendered and loaded on the browser. So it allows executing arbitrary javascript code that was injected into attachment before. Proof of Concept PoC.svg var...

Google Chrome New Tab Page Input Validation Error Vulnerability

Google Chrome is a web browser from Google, Inc. A vulnerability exists in the new tab page component of Google Chrome prior to version 96.0.4664.93. It allows remote attackers to compromise cross-domain data via crafted HTML pages...

Google Chrome Mojo code execution vulnerability

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome, which stems from a lack of validation of data in Mojo. A remote attacker could exploit this vulnerability to cause a denial of service or execute arbitrary code on the system...

Google Chrome ANGLE security bypass vulnerability

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome that stems from an object lifecycle issue in ANGLE. An attacker could use this vulnerability to bypass security restrictions...

Apple iOS Update Fixes Cringey iPhone 13 Jailbreak Exploit

As if the Log4Shell hellscape wasn’t already driving everybody starkers, it’s time to update iOS 15.2 and a crop of other Apple iGadgets, lest your iPhone get taken over by a malicious app that executes arbitrary code with kernel privileges. To paraphrase one mobile security expert, the iOS 15.2...

CVE-2021-42063

A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web browser enables unauthorized attackers to conduct XSS attacks, which might lead to disclose sensitive data...

CVE-2021-42063

A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web browser enables unauthorized attackers to conduct XSS attacks, which might lead to disclose sensitive data...

OpenSearch Web browser has an unspecified vulnerability

OpenSearch Web browser is a Web browser. openSearch Web browser 1.0.0 has a security vulnerability that stems from the application's weak permissions on configuration files. No detailed vulnerability details are currently available...

A week in security (Dec 6 – 12)

Last week on Malwarebytes Labs: Log4j zero-day “Log4Shell” arrives just in time to ruin your weekend Click “OK” to defeat MFA Fake job interviews plague major game developers like Riot Games and Rockstar Has your WordPress site been backdoored by a skimmer? What is a search engine and why does...

Mozilla Firefox Cross-Site Scripting Vulnerability (CNVD-2021-99615)

Mozilla Firefox is an open source Web browser from the Mozilla Foundation in the U.S. A cross-site scripting vulnerability exists in Mozilla Firefox, which can be exploited by attackers to use the CSP sandbox command, where loaded documents can escape the scripting restrictions of the sandbox by...

Google Chrome Type Obfuscation Vulnerability (CNVD-2022-02735)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a type confusion vulnerability that stems from a type confusion error in Chrome. An attacker could exploit this vulnerability to execute arbitrary code in the context of a sandboxed rendering process...

Mozilla Firefox Access Control Error Vulnerability (CNVD-2021-99623)

Mozilla Firefox is an open source Web browser from the Mozilla Foundation. Mozilla Firefox has an access control error vulnerability that originates when the Web extension directory is reloaded and the application fails to prevent the Web extension from accessing the redirected URL of the click...

Mozilla Firefox conditional competition issue vulnerability

Mozilla Firefox is an open source Web browser from the Mozilla Foundation. Mozilla Firefox is vulnerable to a conditional competition issue, which could be exploited by an attacker to force a notification to receive full-screen and pointer-locked access to the page...