Jenkins Build-Publisher plugin has Insufficiently Protected Credentials

Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.buildpublisher.BuildPublisher.xml in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyone with local file system access to acce...

XSS in JSON: Old-School Attacks for Modern Applications

I recently wrote a blog post on injection-type vulnerabilities and how they were knocked down a few spots from 1 to 3 on the new OWASP Top 10 for 2022. The main focus of that article was to demonstrate how stack traces could be — and still are — used via injection attacks to gather information...

USN-5394-1: WebKitGTK vulnerabilities

A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service...

Minor update (6) for Vivaldi Desktop Browser 5.2

Download Vivaldi The following improvements were made since the fifth 5.2 stable, minor update: Chromium Upgraded to 100.0.4896.133 includes fix for CVE-2022-1364 Main photo byVidar Nordli-Mathisen...

Organizr file upload vulnerability

Organizr is a tab management system. Designed to be a one-stop store for server front ends, Organizr versions prior to 2.1.1810 have a file upload vulnerability that stems from the lack of valid validation of uploaded files by the application, which can be exploited by attackers to upload .svg...

Persistent Cross-site Scripting vulnerability in PrivateBin

In PrivateBin polygon id="triangle" points="0,0 0,50 50,0" fill="00990...

CVE-2022-24074

CVE-2022-24074 affects Whale Browser prior to 3.12.129.18, where the default extension Whale Bridge could receive any SendMessage request from the content script itself. This could allow an attacker to control Whale Bridge if the rendering process is compromised. The reported remediation is to up...

Safari < 15.4 Multiple Vulnerabilities

Binary data 701395.pasl...

Automatic Question Paper Generator System 1.0 Cross Site Scripting Vulnerability

Exploit Title: Automatic Question Paper Generator System 1.0 - Cross-site scripting stored Exploit Author: Mr Empy Software Link: https://www.sourcecodester.com/php/15190/automatic-question-paper-generator-system-phpoop-free-source-code.html Version: 1.0 Tested on: Linux Title: ================...

CVE-2022-24762

CVE-2022-24762 affects sysend.js, a library for inter-page messaging in the same browser. The vulnerability arises from cross-origin communication where messages may be intercepted, leaking information. The impact focuses on confidentiality (high severity per CVSS 3.1/3.1 metrics) and is constrai...

GHSA-7563-75J9-6H5P Sensitive Information Exposure in Sylius

Impact Any other user can view the data if the browser tab remains open after logging out. Once someone logs out and leaves the browser open, the potential attacker may use the back button to see the content exposed on given screens. No action may be performed though, and any website refresh will...

MGASA-2022-0099 Updated chromium-browser-stable packages fix security vulnerability

The chromium-browser-stable package has been updated to the 99.0.4844.51 version that fixes multiples security vulnerabilities...

Automatic Question Paper Generator System 1.0 Cross Site Scripting

Exploit Title: Automatic Question Paper Generator System 1.0 - Cross-site scripting stored Date: 2022-11-03 Exploit Author: Mr Empy Software Link: https://www.sourcecodester.com/php/15190/automatic-question-paper-generator-system-phpoop-free-source-code.html Version: 1.0 Tested on: Linux Title:...

CVE-2022-24917

An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all...

SUSE-SU-2022:0676-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 91.6.0 ESR / MFSA 2022-05 bsc1195682 - CVE-2022-22753: Privilege Escalation to SYSTEM on Windows via Maintenance Service - CVE-2022-22754: Extensions could have bypassed permission confirmation during upda...

How to Use Google Chrome's Enhanced Safety Mode

You get a safer, more secure browser experience, but Google gets a lot more data about you...

Cross-site Scripting (XSS) - Stored

Description Stored XSS is a vulnerability in which the attacker can execute arbitrary javascript code in the victim's browser. The XSS payload is stored in a webpage and it gets executed whenever someone visits that webpage. I used &10 Line Feed character in the href attribute of tag to bypass th...

Cross-site Scripting (XSS)

enshrined/svg-sanitize is vulnerable to cross-site scripting. The library uses HTML in SVG markup, allowing an attacker to inject and execute malicious javascript on victim's browser causing system hangs...

Siemens SICAM MMU, SICAM T, and SICAM SGU Buffer Copy Without Checking Size of Input (CVE-2020-10042)

A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. A buffer overflow in various positions of the web application might enable an attacker with access to the web application to execute arbitrary code over the network. This plugi...

Siemens SICAM MMU, SICAM T, and SICAM SGU Improper Neutralization of Input During Web Page Generation (CVE-2020-10041)

A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. A stored Cross-Site-Scripting XSS vulnerability is present in different locations of the web application. An attacker might be able to take over a session of a legitimate user...