Design/Logic Flaw

The YouTube Embedded 1.2 SDK binds to a service within the YouTube Main App. After binding, a remote context is created with the flags Context.CONTEXTINCLUDECODE | Context.CONTEXTIGNORESECURITY. This allows the client app to remotely load code from YouTube Main App by retrieving the Main App’s...

CVE-2023-0460 Remote code execution in YouTube Android Player API SDK

The YouTube Embedded 1.2 SDK binds to a service within the YouTube Main App. After binding, a remote context is created with the flags Context.CONTEXTINCLUDECODE | Context.CONTEXTIGNORESECURITY. This allows the client app to remotely load code from YouTube Main App by retrieving the Main App’s...

CVE-2023-0460 Remote code execution in YouTube Android Player API SDK

The YouTube Embedded 1.2 SDK binds to a service within the YouTube Main App. After binding, a remote context is created with the flags Context.CONTEXTINCLUDECODE | Context.CONTEXTIGNORESECURITY. This allows the client app to remotely load code from YouTube Main App by retrieving the Main App’s...

CVE-2023-0460

The CVE-2023-0460 entry describes a vulnerability in YouTube Embedded 1.2 SDK: after binding to the YouTube Main App, the SDK creates a remote context with Context.CONTEXT_INCLUDE_CODE and Context.CONTEXT_IGNORE_SECURITY, enabling the client app to load code via the Main App’s ClassLoader. The is...

Alphabet YouTube Embedded 安全漏洞

Alphabet YouTube Embedded is a video sharing application from Alphabet USA. A security vulnerability exists in the Alphabet YouTube Embedded version 1.2 SDK, which stems from a ClassLoader that the SDK can load for malicious applications...

PT-2023-16286 · Google · Youtube Embedded 1.2 Sdk

Name of the Vulnerable Software and Affected Versions: YouTube Embedded 1.2 SDK Description: The YouTube Embedded 1.2 SDK has a potential vulnerability in its binding logic. After binding to a service within the YouTube Main App, a remote context is created with the flags Context.CONTEXT INCLUDE...

WordPress Smart YouTube PRO Plugin <= 4.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Smart YouTube PRO Type Plugin Vulnerable versions = 4.3 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25475 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 73f3aad1c009 Credits Mika Required privile...

WordPress YouTube Channel Plugin <= 3.23.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software YouTube Channel Type Plugin Vulnerable versions = 3.23.3 Fixed in 3.23.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25987 Patch priority Low CVSS severity Low 4.3 Developer Aleksandar Urošević PSID fad79021f069 Credits Mika Required...

WordPress Simple YouTube Responsive Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

Software Simple YouTube Responsive Type Plugin Vulnerable versions = 2.5 Fixed in 3.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25982 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5dfa35a7f50c Credits yuyudhn Required...

Simple YouTube Responsive < 3.0 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

A Bootiful Podcast: It's Glenn Renfro! Listen to this episode if you want to feel better

Hi, Spring fans! Today Josh Long @starbuxman talks to Atlanta JUG, Devnexus, Spring Cloud Task, Spring Integration, Spring Cloud Dataflow luminary, and the living embodiment of the word "joy:" Glenn Renfro @cppwfs Watch the podcast in living color on Youtube!...

Researchers Discover Numerous Samples of Information Stealer 'Stealc' in the Wild

A new information stealer called Stealc that's being advertised on the dark web could emerge as a worthy competitor to other malware of its ilk. "The threat actor presents Stealc as a fully featured and ready-to-use stealer, whose development relied on Vidar, Raccoon, Mars, and RedLine stealers,"...

WordPress Video Gallery – YouTube Gallery Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)

Software Video Gallery – YouTube Gallery Type Plugin Vulnerable versions = 1.7.6 Fixed in 1.7.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25979 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID bf4c411df4a1 Credits yuyudhn...

WordPress Video Gallery – YouTube Gallery Plugin <= 1.7.6 is vulnerable to Broken Access Control

Software Video Gallery – YouTube Gallery Type Plugin Vulnerable versions = 1.7.6 Fixed in 1.7.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25988 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 1684686ddd67 Credits István Márt...

SUSE CVE-2018-6360

mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted web site, because it reads HTML documents containing VIDEO elements, and accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdlhook.lua. For example, an av://lavfi:ladspa=file= UR...

CVE-2022-4783

The Youtube Channel Gallery WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

CVE-2022-4783

The CVE-2022-4783 entry covers the WordPress plugin Youtube Channel Gallery (versions up to and including 2.4). The vulnerability arises from not validating/escaping certain shortcode attributes before they are output in pages/posts, enabling Stored XSS for users with the Contributor role or high...

CVE-2022-4783 Youtube Channel Gallery <= 2.4 - Contributor+ Stored XSS via Shortcode

The Youtube Channel Gallery WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

WordPress plugin Youtube Channel Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

CVE-2022-4756

The My YouTube Channel WordPress plugin before 3.23.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...