Deluge Web-UI 跨站脚本漏洞

Deluge Web-UI is a full-featured interface built using the ExtJS framework. A security vulnerability exists in Deluge Web-UI because it does not properly sanitize data in torrent files and parses it directly as HTML, allowing whoever provides a malicious torrent file to a user to execute arbitrar...

Google Chrome 跨站脚本漏洞

Google Chrome is a web browser from Google, Inc. in the United States. A security vulnerability exists in Google Chrome versions prior to 104.0.5112.101, which stems from an improper implementation in the Extensions API...

Vulnerability of browser extensions in Google Chrome and Microsoft Edge, allowing attackers to expose protected information

The vulnerability of Google Chrome and Microsoft Edge browser extensions is related to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

UBUNTU-CVE-2022-1863

Use after free in Tab Groups in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction...

The vulnerability affects the implementation of WASM technology in browsers like Firefox, Firefox ESR, and the email client Thunderbird. This allows attackers to trigger a service failure.

The vulnerability of the WASM technology implementation in Firefox browsers, Firefox ESR, and the Thunderbird email client is related to unlimited resource allocation. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to insecure page caching in the Internet Explorer browser, which allows interpolation of elements. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicio...

CVE-2022-23713

A cross-site-scripting XSS vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a victim’s browser...

UBUNTU-CVE-2022-34471

When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifest had been tampered with on the server, an attacker could trick the browser into downgrading the addon to a prior version. This...

The vulnerability of the lg_init() function in the Mozilla Firefox browser allows a hacker to execute arbitrary code.

The vulnerability of the Mozilla Firefox browser is related to the manipulation of the zero pointer. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2022-26497

Vulnerability (CVE-2022-26497) affects BigBlueButton Greenlight 2.11.1. An attacker can embed a JavaScript payload in a username, which is executed in the victim’s browser when the attacker previously shared access to a room and the user interacts with the Share room access dialog. Root cause: cr...

Plone XSS in User Fullname Property and File Upload

Plone CMS until version 5.2.4 has a stored Cross-Site Scripting XSS vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and...

Credentials transmitted in plain text by OpenShift Deployer Plugin

OpenShift Deployer Plugin stores credentials in its global configuration file org.jenkinsci.plugins.openshift.DeployApplication.xml on the Jenkins controller as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in the Messaging component of Google Chrome versions prior to 102.0.5005.61, which arises from a mix-up in the instructions responsible for freeing memory in the Messaging component program...

GHSA-W969-PQ6X-267J INTER-Mediator Cross-Site Scripting (XSS)

Multiple Cross-Site Scripting XSS issues were discovered in INTER-Mediator 5.5. The vulnerabilities exist due to insufficient filtration of user-supplied data c and cred passed to the "INTER-Mediator-master/AuthSupport/PasswordReset/resetpassword.php" URL. An attacker could execute arbitrary HTML...

Design/Logic Flaw

A vulnerability affecting F-Secure SAFE browser was discovered. An attacker can potentially exploit Javascript window.open functionality in SAFE Browser which could lead address bar spoofing attacks...

Elgg Reflected XSS Vulnerability

VULNERABILITY DESCRIPTION The internalname parameter is not properly sanitized, which allows attacker to conduct Cross Site Scripting attack. This may allow an attacker to create a specially crafted URL that would execute arbitrary script code in a victim's browser PROOF-OF-CONCEPT/EXPLOIT http...

Phoenix Arbitrary URL Redirect

The Phoenix team designed Phoenix.Controller.redirect/2 to protect against redirects allowing user input to redirect to an external URL where your application code otherwise assumes a local path redirect. This is why the :to option is used for “local” URL redirects and why you must pass the...

Microsoft Edge browser’s vulnerability, related to improper code generation management, allows attackers to escalate their privileges.

The vulnerability of Microsoft Edge is related to incorrect code generation management. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

Microsoft Edge browser’s vulnerability, related to improper code generation management, allows attackers to escalate their privileges.

The vulnerability of Microsoft Edge is related to improper handling of code generation. Exploiting this vulnerability allows a malicious actor to enhance their privileges through a specially created web page...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, Inc. and V8 is an open source JavaScript engine. A security vulnerability exists in Google Chrome V8 prior to version 100.0.4896.75, which stems from a type confusion issue. A remote attacker can exploit this vulnerability to potentially cause heap...