Zyxel NAS326 Operating System Command Injection Vulnerability

Zyxel NAS326 is a cloud storage NAS from China Heqin Zyxel. An operating system command injection vulnerability exists in Zyxel NAS326 V5.21AAZF.14C0 and NAS542 V5.21ABAG.11C0 and prior versions, which stems from incorrect neutralization of a special element that could allow an unauthenticated...

The vulnerability of the Universal Monitoring System Interface of Zabbix, which allows attackers to perform cross-site scripting attacks

The vulnerability of the Zabbix monitoring system’s universal interface is related to insufficient validation of input data during the processing of the URL fields in the Maps elements. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

CVE-2023-39067

Cross Site Scripting vulnerability in ZLMediaKiet v.4.0 and v.5.0 allows an attacker to execute arbitrary code via a crafted script to the URL...

CVE-2023-4279

creationtimestamp| type| source ---|---|--- 2023-09-04 16:16:26+00:00| seen| https://t.me/cibsecurity/69784 2023-09-24 08:31:20+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/5193 2025-11-16 20:20:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3m5rjui7ivl2g...

UBUNTU-CVE-2023-1279

An issue has been discovered in GitLab affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 where it was possible to create a URL that would redirect to a different project...

CVE-2018-25089

A vulnerability was found in glb Meetup Tag Extension 0.1 on MediaWiki. It has been rated as problematic. This issue affects some unknown processing of the component Link Attribute Handler. The manipulation leads to use of web link to untrusted target with window.opener access. Upgrading to versi...

CVE-2018-25089

CVE-2018-25089 affects glb Meetup Tag Extension for MediaWiki (version 0.1). Root cause involves the Link Attribute Handler allowing manipulation leading to a web link being opened in a context with window.opener access (classic reverse tabnabbing risk). Upgrading to version 0.2 mitigates the iss...

CVE-2018-25089 glb Meetup Tag Extension Link Attribute reverse tabnabbing

A vulnerability was found in glb Meetup Tag Extension 0.1 on MediaWiki. It has been rated as problematic. This issue affects some unknown processing of the component Link Attribute Handler. The manipulation leads to use of web link to untrusted target with window.opener access. Upgrading to versi...

D-Link DIR-823G URL Field Buffer Overflow Vulnerability

The D-Link DIR-823G is a home dual-band Gigabit wireless router with second-generation 802.11ac Wi-Fi5 technology designed for medium- to high-speed broadband networks. The D-Link DIR-823G suffers from a buffer overflow vulnerability that stems from a buffer overflow vulnerability in the URL fiel...

Cross-Site Scripting (Stored XSS)

Description With Association's board role, i can add a new web link. But, when i create a link, in Link name input field can insert an onfocus/autofocus attribute because do not processing for double quote. Proof of Concept 1. Login by account with Association's board role 2. Access funtion Web...

Google Mandates Android Apps to Offer Easy Account Deletion In-App and Online

Google is enacting a new data deletion policy for Android apps that allow account creation to also offer users with a setting to delete their accounts in an attempt to provide more transparency and control over their data. "For apps that enable app account creation, developers will soon need to...

CVE-2022-4927

A vulnerability was found in ualbertalib NEOSDiscovery 1.0.70 and classified as problematic. This issue affects some unknown processing of the file app/views/bookmarks/refworks.html.erb. The manipulation leads to use of web link to untrusted target with window.opener access. The attack may be...

CVE-2022-4927 ualbertalib NEOSDiscovery _refworks.html.erb reverse tabnabbing

A vulnerability was found in ualbertalib NEOSDiscovery 1.0.70 and classified as problematic. This issue affects some unknown processing of the file app/views/bookmarks/refworks.html.erb. The manipulation leads to use of web link to untrusted target with window.opener access. The attack may be...

CVE-2022-4927 ualbertalib NEOSDiscovery _refworks.html.erb reverse tabnabbing

A vulnerability was found in ualbertalib NEOSDiscovery 1.0.70 and classified as problematic. This issue affects some unknown processing of the file app/views/bookmarks/refworks.html.erb. The manipulation leads to use of web link to untrusted target with window.opener access. The attack may be...

NEOSDiscovery 安全漏洞

NEOSDiscovery is the Discovery interface to the NEOS library. A security vulnerability exists in ualbertalib NEOSDiscovery versions prior to 1.0.71, which stems from the ability to use a web link to untrusted targets with access rights...

USN-5898-1 openjdk-8 vulnerabilities

It was discovered that the Serialization component of OpenJDK did not properly handle the deserialization of some CORBA objects. An attacker could possibly use this to bypass Java sandbox restrictions. CVE-2023-21830 Markus Loewe discovered that the Java Sound subsystem in OpenJDK did not properl...

The Secret Vulnerability Finance Execs are Missing

The Other Risk in Finance A few years ago, a Washington-based real estate developer received a document link from First American – a financial services company in the real estate industry – relating to a deal he was working on. Everything about the document was perfectly fine and normal. The odd...

SUSE CVE-2015-5342

The choice module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote authenticated users to bypass intended access restrictions by visiting a URL to add or delete responses in the closed state...

SUSE CVE-2016-7031

The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL...

SUSE CVE-2017-2862

An exploitable heap overflow vulnerability exists in the gdkpixbufjpegimageloadincrement functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability...