in zikula/core

Description Sensitive data on the application can be exposed after the user logs Proof of Concept // PoC 1 Login to the application 2 Goto page like My Account 3 Click logout 4 Click browser back button Impact When a user logs out without closing the browser someone can view the information insid...

The vulnerability of the SSL-Proxy function of the anonymous web browser Tor allows a perpetrator to trigger a service failure.

The vulnerability of the SSL-Proxy function of the anonymous web browser Tor is related to deficiencies in handling exceptional states. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Cross-site Scripting (XSS) - Reflected in sbrl/pepperminty-wiki

Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into websites. An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execut...

CVE-2020-27970

Yandex Browser before 20.10.0 allows remote attackers to spoof the address bar...

Brave Software: Information disclosure-Referer leak

Assigned to: Brave Assigned by: Kirtikumar Anandrao Ramchandani Assigned on: 13/09/2021 Browser information used to test Up to date: Brave 1.29.79 Chromium: 93.0.4577.63 Official Build 64-bit Revision ff5c0da2ec0adeaed5550e6c7e98417dac77d98a-refs/branch-heads/4577@1135 OS Windows 10 OS Version 20...

ROS-2-2249

2.2249 Mozilla Firefox browser vulnerability CVE-2021-29970, CVE-2021-29976 1. Vulnerability description: CVE-2021-29970 A vulnerability in the Mozilla Firefox browser, is related to a release error in accessibility functions when processing HTML content. Exploitation of the vulnerability could...

Cross-site Scripting (XSS) - Reflected in znixbtw/panel-v2

✍️ Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into websites. An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will...

Cross-Site Request Forgery (CSRF) in admidio/admidio

✍️ Description Attacker able to delete any Link with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attacks it...

The vulnerability of Mozilla Firefox and Firefox ESR browsers relates to the use of memory after it is freed, allowing an attacker to execute arbitrary code.

The vulnerability of Mozilla Firefox and Firefox ESR browsers is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

Cross-Site Request Forgery (CSRF) in admidio/admidio

✍️ Description Attacker able to delete any photo of a user with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF...

Cross-Site Request Forgery (CSRF) in aces/loris

✍️ Description Attacker able to create any Category with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attack...

VulnCheck KEV: CVE-2018-8114

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 11. This CVE ID is unique from CVE-2018-0945, CVE-2018-0946, CVE-2018-0951,...

F-secure Safe 安全漏洞

F-secure F-Secure SAFE is a suite of antivirus software from the Finnish company F-Secure F-secure. A security vulnerability exists in F-secure Safe Browser that stems from a flaw in the product implementation. When a user clicks on a malicious link, the browser address bar displays a legitimate...

URL Redirection to Untrusted Site ('Open Redirect') in Products.isurlinportal

Impact Various parts of Plone use the 'is url in portal' check for security, mostly to see if it is safe to redirect to a url. A url like https://example.org is not in the portal. But the url https:example.org without slashes tricks our code and it is considered to be in the portal. When...

F-Secure SAFE 安全漏洞

F-secure F-Secure SAFE is a suite of antivirus software from the Finnish company F-Secure F-secure. A security vulnerability exists in F-Secure Safe Browser for iOS. An attacker can exploit the vulnerability to trigger a url redirection...

Cross-Site Request Forgery (CSRF) in zhongshaofa/easyadmin

✍️ Description Attacker able to delete any admin with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attacks i...

Cross-Site Request Forgery (CSRF) in zhongshaofa/easyadmin

✍️ Description Attacker able to modify any menu with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attacks it...

DELL Dell EMC iDRAC9 跨站脚本漏洞

Dell EMC iDRAC9 is a hardware and software-based system management solution from Dell DELL. The solution provides remote management, crash system recovery and power control for Dell PowerEdge systems. cross-site scripting vulnerability exists in versions prior to Dell EMC iDRAC9 4.40.40.00. A...

U.S. Dept Of Defense: RXSS ON https://██████████

Description: Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differe...

Design/Logic Flaw

Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...