Mozilla: The proxy.onRequest API did not catch view-source URLs

The Mozilla Foundation Security Advisory describes this flaw as: When an extension with the proxy permission registered to receive , the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening View Source could have...

Mozilla: The proxy.onRequest API did not catch view-source URLs

The Mozilla Foundation Security Advisory describes this flaw as: When an extension with the proxy permission registered to receive , the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening View Source could have...

Mozilla: The proxy.onRequest API did not catch view-source URLs

The Mozilla Foundation Security Advisory describes this flaw as: When an extension with the proxy permission registered to receive , the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening View Source could have...

Mozilla: The proxy.onRequest API did not catch view-source URLs

The Mozilla Foundation Security Advisory describes this flaw as: When an extension with the proxy permission registered to receive , the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening View Source could have...

The new Wondershare PDFelement with added features

By Sudais Asif PDFelement is an all-in-one PDF solution allowing users to edit, convert, and optimise documents securely. Here's how it works. This is a post from HackRead.com Read the original post: The new Wondershare PDFelement with added features...

CVE-2020-28858: Cross-Site Request Forgery (CSRF)

OpenAsset Digital Asset Management DAM through 12.0.19 does not correctly verify whether a request made to the application was intentionally made by the user, allowing for cross-site request forgery attacks on all user functions...

Silver Peak Systems EdgeConnect Software Operating System Command Injection Vulnerability

Silver Peak Systems EdgeConnect Software ECOS is a suite of software-defined, wide-area networking platforms from Silver Peak Systems, USA. The platform provides features such as path conditioning, application classification, routing, and virtual WAN overlays. Silver Peak Systems EdgeConnect...

CVE-2020-8920

An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users'...

CVE-2020-8920

An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users'...

CVE-2020-8920

CVE-2020-8920 describes an information-leak in Gerrit where an over-optimization in the FilteredRepository wrapper bypasses access checks on All-Users repositories, allowing read access to users’ personal information. Affected versions are Gerrit before 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, ...

Siemens LOGO! 8 BM Improper Encryption Algorithm Vulnerability

Siemens LOGO! 8 BM is a programming software for industrial environments for the Windows platform from Siemens Germany. A security vulnerability exists in Siemens LOGO! 8 BM, which can be exploited by an attacker to gain unauthorized full access to all services...

Gitlab Denial of Service Vulnerability (CNVD-2020-70850)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A denial of service vulnerability exists in all versions ...

Siemens LOGO! 8 BM 加密问题漏洞

Siemens LOGO! 8 BM is a programming software for industrial environments for the Windows platform from Siemens Germany. A security vulnerability exists in Siemens LOGO! 8 BM, which can be exploited by an attacker to gain unauthorized full access to all services...

Cloudbees Jenkins 授权问题漏洞

Cloudbees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . CVS Plugin is used in one of the CVS versi...

Cloudbees Jenkins 授权问题漏洞

Cloudbees Jenkins Hudson Labs is the United States CloudBees Cloudbees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . A security vulnerability exists in...

Unbreakable Enterprise kernel security update

4.1.12-124.45.6 - qla2xxx: disable target reset during link reset and update version Quinn Tran Orabug: 32095664 - scsi: qla2xxx: Fix early srb free on abort Quinn Tran Orabug: 32095664 - scsi: qla2xxx: Fix comment in MODULEPARMDESC in qla2xxx Masanari Iida Orabug: 32095664 - scsi: qla2xxx: Enabl...

ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)

Exploit Title: ChurchCRM 4.2.1- Persistent Cross Site ScriptingXSS Date: 2020- 10- 29 Exploit Author: Mufaddal Masalawala Vendor Homepage: https://churchcrm.io/ Software Link: https://github.com/ChurchCRM/CRM Version: 4.2.1 Tested on: Kali Linux 2020.3 Proof Of Concept: ChurchCRM application allo...

CVE-2020-26250

OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated in jupyterhub 1.2 configuration Authenticator.whitelist, which should be transparently mapped to Authenticator.allowedusers with a warning, is instead ignored by...

Moderate: Red Hat Security Advisory: rh-php73-php security, bug fix, and enhancement update

An update for rh-php73-php is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Chengdu Enable Technology Co., Ltd Vocational College Smart Campus Platform Has Logic Flaw Vulnerability

Chengdu Enable Technology Co., Ltd. is a high-tech enterprise and software enterprise in education informatization industry. A logic flaw vulnerability exists in the Vocational College Smart Campus Platform of Chengdu Enable Technology Co. An attacker can exploit the vulnerability to cause all...