71 matches found
Cross site scripting
In Factor App Framework & Headless CMS forum plugin, versions v1.3.8 to v1.8.30, are vulnerable to reflected Cross-Site Scripting XSS at the “tags” and “category” parameters in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...
CVE-2021-25985
In Factor (App Framework & Headless CMS) from v1.0.4 through v1.8.30, the vulnerability stems from improperly invalidating a user session after logout and storing sessions in browser local storage (which has no expiration). This enables an attacker to steal and reuse session data via XSS, potenti...
CVE-2021-25984 FactorJS - Stored Cross-Site Scripting (XSS) in Post Reply Functionality
In Factor App Framework & Headless CMS forum plugin, versions v1.3.3 to v1.8.30, are vulnerable to stored Cross-Site Scripting XSS at the “post reply” section. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...
CVE-2021-25984: Improper Neutralization of Input During Web Page Generation
In Factor App Framework & Headless CMS forum plugin, versions v1.3.3 to v1.8.30, are vulnerable to stored Cross-Site Scripting XSS at the “post reply” section. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...
Golang Worm Widens Scope to Windows, Adds Payload Capacity
A new version of a known malware campaign aimed at installing cryptominers has changed up its tactics, adding attacks on Windows servers and a new pool of exploits to its bag of tricks. It is also swiftly evolving to position itself as a backdoor for downloading future, more damaging malware,...
carml (19.1.0), nucypher (>=0.1.0a27, <=1.2.0b1) +3 more potentially affected by CVE-2020-10108 via twisted (19.7.0)
twisted PYPI version 19.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - carml 19.1.0 - nucypher =0.1.0a27, =1.1.0, =1.0.0, =0.2.0, =0.2.1 Source cves: CVE-2020-10108 Source advisory: OSV:GHSA-H96W-MMRF-2H6V...
carml (19.1.0), nucypher (>=0.1.0a27, <=1.2.0b1) +3 more potentially affected by CVE-2020-10109 via twisted (19.7.0)
twisted PYPI version 19.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - carml 19.1.0 - nucypher =0.1.0a27, =1.1.0, =1.0.0, =0.2.0, =0.2.1 Source cves: CVE-2020-10109 Source advisory: OSV:GHSA-P5XH-VX83-MXCJ...
carml (19.1.0), nucypher (>=0.1.0a27, <=1.2.0b1) +3 more potentially affected by CVE-2020-10108 via twisted (19.7.0)
twisted PYPI version 19.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - carml 19.1.0 - nucypher =0.1.0a27, =1.1.0, =1.0.0, =0.2.0, =0.2.1 Source cves: CVE-2020-10108 Source advisory: OSV:PYSEC-2020-259...
CVE-2015-5632
The Newphoria applican framework vulnerability (Android versions prior to 1.12.3; iOS prior to 1.12.2) is a URL whitelist bypass in the runtime engine. When an app is launched via the URL-scheme, the whitelist.xml protection can be bypassed and non‑whitelisted URLs may be accessed, enabling an AP...
Ruby on Rails Patches DoS, XSS Vulnerabilities
The developers of Ruby on Rails, the popular web app framework, released four new versions of the product yesterday, complete with fixes for a series of vulnerabilities that could have lead to denial of service attacks and XSS injections. Four vulnerabilities in total are addressed in versions...
