Design/Logic Flaw

User Interface UI Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the RITS Browser version 3.3.9 and prior versions...

CVE-2020-7371

CVE-2020-7371 describes a UI misrepresentation in the address bar exploited via JavaScript timing to spoof the perceived source of content in the RITS Browser 3.3.9 and earlier. Exploitation requires visiting a site that can run JavaScript; the attacker can cause UI elements to appear as if they ...

CVE-2020-7371 Raise IT Solutions RITS Browser Address Bar Spooofing

User Interface UI Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the RITS Browser version 3.3.9 and prior versions...

CVE-2020-7369

Summary of CVE-2020-7369 : A UI misrepresentation vulnerability in Yandex Browser’s address bar allows an attacker to obfuscate the true data source shown to the user. The issue affects Yandex Browser 20.8.3 and earlier and was fixed in 20.8.4 (Oct 1, 2020). The NVD lists a CVSS v3.1 base score o...

CVE-2020-7369 Yandex Browser Address Bar Spooofing

User Interface UI Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Yandex Browser version 20.8.3 and prior versions, and was fixed in version...

Mobile Browser Bugs Open Safari, Opera Users to Malware

A set of address-bar spoofing vulnerabilities that affect a number of mobile browsers open the door for malware delivery, phishing and disinformation campaigns. The bugs, reported by Rapid7 and independent researcher Rafay Baloch, affect six browsers, ranging from the common Apple Safari, Opera...

openSUSE Security Update : opera (openSUSE-2020-635)

This update for opera fixes the following issues : Opera was updated to version 68.0.3618.63 - CHR-7889 Update chromium on desktop-stable-81-3618 to 81.0.4044.122 - CHR-7896 Update chromium on desktop-stable-81-3618 to 81.0.4044.129 - DNA-85287 Set standard spacing for Yandex prompt - DNA-85416 M...

Adamantium-Thief - Decrypt Chromium Based Browsers Passwords, Cookies, Credit Cards, History, Bookmarks

Get chromium browsers: passwords, credit cards, history, cookies, bookmarks. Chrome 80 is supported! Examples: Getpasswords from browsers: Stealer.exe PASSWORDS Get credit cards from browsers: Stealer.exe CREDITCARDS Get history from browsers: Stealer.exe HISTORY Get bookmarks from browsers:...

The Best and Worst Browsers for Privacy, Ranked

A new study examines how Google Chrome, Mozilla Firefox, Apple Safari, Brave, Edge, and Yandex collect user data...

Unspecified Vulnerability in Yandex ClickHouse

Yandex ClickHouse is a set of open source columnar databases for online analytical processing of the Russian company Yandex. A security vulnerability exists in Yandex ClickHouse versions prior to 19.14. An attacker can exploit the vulnerability to execute code or cause a denial of service...

Yandex ClickHouse Arbitrary File Write Vulnerability

Yandex ClickHouse is a set of open source columnar databases for online analytical processing of the Russian company Yandex. A security vulnerability exists in Yandex ClickHouse versions prior to 19.14.3. An attacker can exploit this vulnerability to cause clickhouse-server to perform a write...

McDonalds-Themed Facebook Ads Serve Up Banking Trojans

The Mispadu banking trojan is using a McDonalds malvertising tactic to ultimately steal payment-card data and online banking information. Written in Delphi, Mispadu targets Brazil and Mexico, uses pop-up windows and contains backdoor functionality. According to researchers at ESET, Mispadu spread...

Yandex ClickHouse MySQL client information disclosure vulnerability

Yandex ClickHouse is a set of open source columnar databases for online analytical processing of the Russian company Yandex. An information disclosure vulnerability exists in the Yandex ClickHouse MySQL client. With the 'LOAD DATA LOCAL INFILE' feature enabled, an attacker can leverage a maliciou...

Razy Malware Attacks Browser Extensions to Steal Cryptocurrency

UPDATE A Windows malware dubbed “Razy” has been uncovered that sports a toolbox of cryptocurrency theft and fraud tools. Razy works by weaponizing browser extensions in order to perpetrate a range of online scams on unwitting victims. According to researchers at Kaspersky Lab, the trojan targets...

Node.js third-party modules: [buttle] Unsafe rendering of Markdown files

I would like to report Cross Site Scripting vulnerablity in buttle module It allows to execute arbitary javascript due to unsafe rendering of markdown files. Module module name: buttle version: 0.2.0 npm page: https://www.npmjs.com/package/buttle Module Description Another static file server? Why...

Mail.ru: XSS in e.mail.ru

Приветствую! Нашел XSS на e.mail.ru, при написании письма. Предыстория: Для начала я взял аккаунт на Яндексе с готовым xss вектором в имени ", но возникла некая трудность в плане авторизации, меня не пропускало из за недопустимых символов в имени, тогда я взял смартфон, и авторизовался через...

CVE-2018-14671

unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability. Andrey Krasichkov and Evgeny Sidorov of Yandex Information Security Team...

CVE-2016-10671

mystem-wrapper is a Yandex mystem app wrapper module. mystem-wrapper downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is ...

CVE-2016-10662

tomita is a node wrapper for Yandex Tomita Parser tomita downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the netwo...

Remote code execution

mystem-wrapper is a Yandex mystem app wrapper module. mystem-wrapper downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is ...