Announcing the Microsoft Edge Insider Bounty

This week, we released the first Beta preview of the next version of Microsoft Edge. Alongside this, Microsoft is excited to announce the launch of the Microsoft Edge Insider Bounty Program. We welcome researchers to seek out and disclose any high impact vulnerabilities they may find in the next...

Announcing the Microsoft Edge Insider Bounty

This week, we released the first Beta preview of the next version of Microsoft Edge. Alongside this, Microsoft is excited to announce the launch of the Microsoft Edge Insider Bounty Program. We welcome researchers to seek out and disclose any high impact vulnerabilities they may find in the next...

Xssizer - The Best Tool To Find And Prove XSS Flaws

According to WikiPedia Cross-site scripting is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access...

HexoEditor Cross-Site Scripting Vulnerability

HexoEditor is an open source for Hexo blogging framework has been optimized for Markdown a markup language that can be written using a regular text editor editor. A cross-site scripting vulnerability exists in HexoEditor v1.1.8-beta. The vulnerability stems from a lack of proper validation of...

CVE-2019-1010005

HexoEditor v1.1.8-beta is affected by: XSS to code execution...

CVE-2019-1010005

HexoEditor v1.1.8-beta is affected by: XSS to code execution...

Code injection

HexoEditor v1.1.8-beta is affected by: XSS to code execution...

CVE-2019-1010005

HexoEditor v1.1.8-beta is affected by: XSS to code execution...

CVE-2019-1010005

CVE-2019-1010005 affects HexoEditor v1.1.8-beta. The connected sources describe a cross-site scripting vulnerability that can lead to client-side code execution within the HexoEditor web application, arising from a lack of proper validation of client-side data by the web app. Exploitation details...

Flarum Cross-Site Request Forgery Vulnerability

Flarum is an open source forum system. A cross-site request forgery vulnerability exists in Flarum versions prior to 0.1.0-beta.9. The vulnerability stems from a networked system or product that does not adequately validate the origin or authenticity of data, which can be exploited by an attacker...

CVE-2019-13183

Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings...

CVE-2019-13183

Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings...

D-Link DIR-818LW Command Injection Vulnerability (CNVD-2019-17124)

The D-Link DIR-818LW is a wireless router from AUO D-Link of Taiwan, China. A command injection vulnerability exists in HNAP1 SetWanSettings in the D-Link DIR-818LW versions 2.05.B03 through 2.06B01 BETA. The vulnerability stems from a network system or product not properly filtering specific...

D-Link DIR-818LW Command Injection Vulnerability

The D-Link DIR-818LW is a wireless router from AUO D-Link of Taiwan, China. A command injection vulnerability exists in HNAP1 SetWanSettings in the D-Link DIR-818LW versions 2.05.B03 through 2.06B01 BETA. The vulnerability stems from a network system or product not properly filtering specific...

Is 'Sign in with Apple' Marketing Spin or Privacy Magic? Experts Weigh In

Apple’s “Sign in with Apple” feature promises to protect user privacy – and while many are looking at that claim as more of a marketing move than anything else, authentication experts say it has the potential to have an enormous impact on the data privacy ecosystem. The giant from Cupertino took...

Access control bypass in Apache ZooKeeper

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper?s getACL command doesn?t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider...

UBUNTU-CVE-2019-0201

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider...

PT-2019-5356 · Apache +3 · Apache Zookeeper +3

Name of the Vulnerable Software and Affected Versions: Apache ZooKeeper versions 1.0.0 through 3.4.13 Apache ZooKeeper versions 3.5.0-alpha through 3.5.4-beta Description: The issue is related to ZooKeeper’s getACL command, which does not check any permission when retrieving the ACLs of the...

CVE-2018-12270

In Valve Steam 1528829181 BETA, it is possible to perform a homograph / homoglyph attack to create fake URLs in the client, which may trick users into visiting unintended web sites...

CVE-2018-12270

Affected product: Valve Steam (1528829181 BETA). The vulnerability is a homograph/homoglyph attack that allows creating fake URLs in the Steam client, potentially fooling users into visiting unintended websites. Root cause details are not provided in the documents. Impact is described as user con...