2106 matches found
CVE-2019-10255
CVE-2019-10255 affects Jupyter Notebook and JupyterHub: an open redirect vulnerability allows crafted links to redirect to a malicious site after login. Affected: Jupyter Notebook before 5.7.7 and JupyterHub before 0.9.5 (base description). Public details in connected docs indicate the issue is a...
NetData 1.13.0 - HTML Injection
NetData 1.13.0 - HTML Injection Author: Marcelo Vázquez aka s4vitar NetData v1.13.0 HTML Injection Vulnerability Exploit Title: NetData v1.13.0 HTML Injection Vulnerability Date: 2019-03-14 Exploit Author: Marcelo Vázquez aka s4vitar Collaborators: Victor Lasa aka vowkin Vendor Homepage:...
Microsoft Edge and Internet Explorer CVE-2019-0762 Security Bypass Vulnerability
Description Microsoft Edge and Internet Explorer are prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions. This may lead to other attacks. Technologies Affected Microsoft Edge Microsoft Internet Explorer 10 Microsoft Internet Explore...
Microsoft Skype for Business and Lync Server CVE-2019-0798 Spoofing Vulnerability
Description Microsoft Skype for Business and Lync Server are prone to a spoofing vulnerability. An attacker can exploit this issue to conduct spoofing attacks, execute arbitrary script code in the context of the affected site. This can allow the attacker to steal cookie-based authentication...
Microsoft Team Foundation Server CVE-2019-0777 Cross Site Scripting Vulnerability
Description Microsoft Team Foundation Server is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site...
Microsoft .NET Framework and Visual Studio CVE-2019-0657 Spoofing Vulnerability
Description Microsoft .NET Framework and Visual Studio are prone to an security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies Affect...
Microsoft SharePoint Server CVE-2019-0670 Spoofing Vulnerability
Description Microsoft SharePoint Server is prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies Affected Microsoft...
Microsoft Internet Explorer and Edge CVE-2019-0654 Spoofing Vulnerability
Description Microsoft Internet Explorer and Edge are prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies Affected...
Trend Micro Security’s 2019 Release Protects You Better Than Ever Against Ransomware, Coin-mining, Banking, and E-Commerce Threats
2019 has barely gotten started, but by Q4 of 2018 Trend Micro had already seen a 956% increase in coin-mining malware detections for the year-to-date—right alongside the persistent threat of ransomware and online banking and e-commerce hacks designed to steal your identity or your money. Folks ca...
CVE-2018-16481
The CVE-2018-16481 vulnerability affects html-page
OpenSC Multiple Out Of Bounds Write Denial of Service Vulnerabilities
Description OpenSC is prone to multiple denial-of-service vulnerabilities. Attackers can exploit these issues to cause denial-of-service conditions. Versions prior to OpenSC 0.20.0-rc1 are vulnerable. Technologies Affected Opensc-Project Opensc 0.10.0 Opensc-Project Opensc 0.10.1 Opensc-Project...
CVE-2019-5765
An exposed debugging endpoint in the browser in Google Chrome on Android prior to 72.0.3626.81 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted Intent...
Browser push notifications: a feature asking to be abused
“I’m seeing a lot of ads popping up in the corner of my screen, and the Malwarebytes scan does not show there is anything wrong. It says my computer is clean. So what's happening?” Our support team runs into questions like this regularly, but the volume seems to be increasing lately. In most of...
Ubuntu 18.04 LTS : WebKitGTK+ vulnerabilities (USN-3854-1)
The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3854-1 advisory. A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote...
Design/Logic Flaw
A renderer initiated back navigation was incorrectly allowed to cancel a browser initiated one in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page...
Microsoft Office SharePoint CVE-2019-0556 Cross Site Scripting Vulnerability
Description Microsoft Office SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...
Microsoft Office SharePoint CVE-2019-0557 Cross Site Scripting Vulnerability
Description Microsoft Office SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...
Kaspersky: Kaspersky Protection extension for Google Chrome is vulnerable to abuse its features
Summary The Google Chrome extension "Kaspersky Protection" installed automatically by Kaspersky Internet Security can be tricked by arbitrary websites into uninstalling browser extensions. Description Kaspersky Protection for Google Chrome has some functionality to uninstall malicious browser...
Xxe
S3 Browser before 8.1.5 contains an XML external entity XXE vulnerability, allowing remote attackers to read arbitrary files and obtain NTLMv2 hash values by tricking a user into connecting to a malicious server via the S3 protocol...
Kaspersky: Certificate warnings and similar UI elements in Web protection of Anti-Virus products family are susceptible to clickjacking
Summary Clickjacking can be used to trick users into overriding certificate warnings, disabling Safe Money functionality or phishing alerts. Description On certificate warning pages, a single click is sufficient to trigger overriding a wrong certificate. While an additional warning is displayed...