CVE-2022-1868

The CVE-2022-1868 case concerns Google Chrome’s Extensions API where an improper implementation allowed bypassing navigation restrictions when a user is convinced to install a crafted malicious extension. Affected software is Google Chrome prior to 102.0.5005.61; a fix is reflected in Chrome/chro...

Mozilla: A popup window could be resized in a way to overlay the address bar with web content

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of a malicious website that creates a popup that could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attacks...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome that stems from an improper implementation in the Extensions API...

GHSA-FR2W-MP56-G4XP Unrestricted Attachment Upload

Impact InvenTree allows unrestricted upload of files as attachments to various database fields. Potentially dangerous files such as HTML files containing malicious javascript can be uploaded, and when opened by the user run the malicious code directly in the users browser. Note that the upload of...

Panther Labs: reflected XSS on panther.com

Summary: When visiting runpanther.io I got redirected to panther.com and the application failed to sanitise user's input resulting into HTML injection and possible XSS. Steps To Reproduce: F1774502 1. Go to...

CVE-2022-29618

The connected records confirm a cross-site scripting (XSS) vulnerability in SAP NetWeaver Development Infrastructure (Design Time Repository) affecting versions 7.30, 7.31, 7.40, and 7.50. Root cause: insufficient input validation that lets an unauthenticated attacker inject script into the URL, ...

kuechen-haushaltsgeraete.de Cross Site Scripting vulnerability OBB-2638970

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Mozilla: Browser window spoof using fullscreen mode

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when exiting fullscreen mode, an iframe could have confused the browser about the current state of the fullscreen, resulting in potential user confusion or spoofing attacks...

HCL Technologies Traveler Companion Cross-Site Scripting Vulnerability

HCL Technologies Traveler Companion is an ios Iphone and Ipad application from HCL Technologies, India. It is used to read encrypted Hcl Notes emails on Apple devices.A cross-site scripting vulnerability exists in HCL Technologies Traveler Companion version 12.0.1.0 and earlier, which stems from...

mxGraph vulnerable to cross-site scripting in color field

mxGraph through 4.0.0, related to the draw.io Diagrams plugin before 8.3.14 for Confluence and other products, is vulnerable to cross-site scripting. draw.io Diagrams allows the creation and editing of draw.io-based diagrams in Confluence. Among other things, it allows to set the background color...

MGASA-2022-0188 Updated chromium-browser-stable packages fix security vulnerability

The chromium-browser-stable package has been updated to the 101.0.4951.64 version, fixing many bugs and 13 CVE. Some of them are listed below: 1316990 High CVE-2022-1633: Use after free in Sharesheet. Reported by Khalil Zhani on 2022-04-18 1314908 High CVE-2022-1634: Use after free in Browser UI...

GHSA-28PV-2J2H-FMHC TeamPass Cross-Site Scripting (XSS)

Cross-Site Scripting XSS was discovered in TeamPass before 2.1.27.9. The vulnerability exists due to insufficient filtration of data in /sources/folders.queries.php. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website...

Improper Neutralization of Input During Web Page Generation in Dojo Dojo Objective Harness

Dojo Dojo Objective Harness DOH version prior to version 1.14 contains a Cross Site Scripting XSS vulnerability in unit.html and testsDOH/base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/base/i18nExhaustive.js in the DOH that can result in Victim attacked through their browser - deliv...

Jenkins Build-Publisher plugin has Insufficiently Protected Credentials

Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.buildpublisher.BuildPublisher.xml in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyone with local file system access to acce...

XSS in JSON: Old-School Attacks for Modern Applications

I recently wrote a blog post on injection-type vulnerabilities and how they were knocked down a few spots from 1 to 3 on the new OWASP Top 10 for 2022. The main focus of that article was to demonstrate how stack traces could be — and still are — used via injection attacks to gather information...

USN-5394-1: WebKitGTK vulnerabilities

A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service...

Minor update (6) for Vivaldi Desktop Browser 5.2

Download Vivaldi The following improvements were made since the fifth 5.2 stable, minor update: Chromium Upgraded to 100.0.4896.133 includes fix for CVE-2022-1364 Main photo byVidar Nordli-Mathisen...

Organizr file upload vulnerability

Organizr is a tab management system. Designed to be a one-stop store for server front ends, Organizr versions prior to 2.1.1810 have a file upload vulnerability that stems from the lack of valid validation of uploaded files by the application, which can be exploited by attackers to upload .svg...

Persistent Cross-site Scripting vulnerability in PrivateBin

In PrivateBin polygon id="triangle" points="0,0 0,50 50,0" fill="00990...

CVE-2022-24074

CVE-2022-24074 affects Whale Browser prior to 3.12.129.18, where the default extension Whale Bridge could receive any SendMessage request from the content script itself. This could allow an attacker to control Whale Bridge if the rendering process is compromised. The reported remediation is to up...