2100 matches found
MAL-2023-1648 Malicious code in beutifulsoup4 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: checkmarx a74a36adea067d56842d1606f1bbeaa5d66d302d2c3d33a520d76b46ec81846b Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...
Cross-Site Scripting (XSS)
org.apache.sling:org.apache.sling.cms is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape the special characters before it output to the front end, allowing an attacker to inject and execute malicious JavaScript on victim's browser...
The vulnerability of the Mozilla Firefox browser for Android, related to state management errors, allows a hacker to exploit the system to disclose protected information.
The vulnerability of the Mozilla Firefox browser for Android is related to state management errors. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information that is protected by the browser’s security features...
The Definitive Browser Security Checklist
Security stakeholders have come to realize that the prominent role the browser has in the modern corporate environment requires a re-evaluation of how it is managed and protected. While not long-ago web-borne risks were still addressed by a patchwork of endpoint, network, and cloud solutions, it ...
The Definitive Browser Security Checklist
Security stakeholders have come to realize that the prominent role the browser has in the modern corporate environment requires a re-evaluation of how it is managed and protected. While not long-ago web-borne risks were still addressed by a patchwork of endpoint, network, and cloud solutions, it ...
Ubuntu: Security Advisory (USN-5797-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Mitigate the LastPass Attack Surface in Your Environment with this Free Tool
The latest breach announced by LastPass is a major cause for concern to security stakeholders. As often occurs, we are at a security limbo – on the one hand, as LastPass has noted, users who followed LastPass best practices would be exposed to practically zero to extremely low risk. However, to s...
CVE-2022-34471
When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifest had been tampered with on the server, an attacker could trick the browser into downgrading the addon to a prior version. This...
CVE-2022-34469
When a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should not allow the user to bypass the certificate error. On Firefox for Android, the user was presented with the option to bypass the error; this could only have been done by the user explicitly. This bug...
CVE-2022-45411
Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript such as cookies protected by HTTPOnly. To mitigate this attack, browsers placed limits on fetch and XMLHttpReques...
CVE-2022-34469
When a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should not allow the user to bypass the certificate error. On Firefox for Android, the user was presented with the option to bypass the error; this could only have been done by the user explicitly. This bug...
CVE-2022-46877
CVE-2022-46877 describes a fullscreen notification bypass in Firefox prior to version 108, where the fullscreen notification could be delayed or suppressed, potentially allowing user confusion or spoofing. Affected product: Firefox (
CVE-2022-45411
CVE-2022-45411: Cross-Site Tracing vulnerability in Firefox/Thunderbird due to servers echoing Trace requests and exposure of authorization headers/cookies; mitigations have been implemented via browser fetch/XHR limits and non-standard headers like X-Http-Method-Override. The issue is acknowledg...
Cross site scripting
Adobe Experience Manager version 6.5.14 and earlier is affected by a reflected Cross-Site Scripting XSS vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...
Cross site scripting
Adobe Experience Manager version 6.5.14 and earlier is affected by a reflected Cross-Site Scripting XSS vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...
Adobe Experience Manager Cross-Site Scripting Vulnerability (CNVD-2023-15822)
Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications and forms. The solution supports mobile content management, marketing and sales campaign management, and multi-site management, etc. A cross-site scripting vulnerabilit...
Adobe Experience Manager Cross-Site Scripting Vulnerability (CNVD-2023-00604)
Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications and forms. The solution supports mobile content management, marketing and sales campaign management, and multi-site management, etc. A cross-site scripting vulnerabilit...
CVE-2022-3853
CVE-2022-3853 describes a Cross-site Scripting (XSS) vulnerability in the WordPress plugin Supra CSV (≤ 4.0.3) caused by a stored XSS via CSRF. Affected component: Supra CSV WordPress plugin. Public references state the issue as stored XSS via CSRF; no explicit exploit details or in‑the‑wild expl...
MGASA-2022-0451 Updated chromium-browser-stable packages fix security vulnerability
The chromium-browser-stable package has been updated to the new 108 branch with the 108.0.5359.94 release, fixing many bugs and 29 vulnerabilities, together with 107.0.5304.121 and 108.0.5359.71. Some of the security fixes are - CVE-2022-4174: Type Confusion in V8. Reported by Zhenghang Xiao...
