GHSA-255W-87RH-RG44 Cross-site Scripting via uploaded SVG

In Sulu v2.0.0 through v2.6.4 are vulnerable against XSS whereas a low privileged user with an access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on the victims’ other users including admins browsers...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability previously existed in Mozilla Firefox version 131, which stemmed from the inclusion of a memory security hole...

Dassault Systèmes 3DEXPERIENCE 安全漏洞

Dassault Systèmes 3DEXPERIENCE is a business and innovation platform from Dassault Systèmes France. A security vulnerability exists in Dassault Systèmes 3DEXPERIENCE, which originated. An attacker could exploit the vulnerability to execute arbitrary script code within a user's browser session...

CVE-2024-45799 Javascript Injection in Vending Info/Buyers Info Module in FluxCP

FluxCP is a web-based Control Panel for rAthena servers written in PHP. A javascript injection is possible via venders/buyers list pages and shop names, that are currently not sanitized. This allows executing arbitrary javascript code on the user's browser just by visiting the shop pages. As a...

The vulnerability of Firefox browsers, including Firefox ESR, arises from the absence of a confirmation dialog box when opening Usenet links such as “news:“ and “snews:“. This allows a malicious user to download any application and execute any code.

The vulnerability of Firefox and Firefox ESR lies in the absence of a confirmation dialog box when opening “news:“ and “snews:“ protocols related to Usenet. Exploiting this vulnerability allows an attacker to download arbitrary applications and execute arbitrary code...

IBM Notes Denial Of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "IBM Notes Denial Of Service", 'Description' = %q This module exploits a vulnerability in the native browser that comes with IBM Lotus Notes. If...

mozilla: Fullscreen notification dialog can be obscured by document content

The Mozilla Foundation Security Advisory describes this flaw as: Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack...

The vulnerability of Chromium, Firefox, and Safari browsers lies in errors during the processing of input data, allowing attackers to execute arbitrary code.

The vulnerability of the Chromium, Firefox, and Safari browsers’ software is related to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely, provided that the user clicks on a specially crafted link...

GHSA-RH4R-F7F7-R99M gotortc Cross-site Scripting vulnerability

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The index page index.html shows the available streams by fetching the API in the client side. Then, it uses Object.entries to iterate over the result whose first item name gets...

The vulnerability of the FedCM component in browsers Google Chrome and Microsoft Edge allows a perpetrator to gain unauthorized access to its functional features.

The vulnerability of the FedCM component in browsers such as Google Chrome and Microsoft Edge is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to the system’s functions...

The vulnerability of the Extensions component of the Google Chrome browser, which allows a hacker to increase their privileges

The vulnerability of the Extensions component of the Google Chrome browser is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to enhance their privileges through a specially created Chrome extension...

EUVD-2024-2328

Fides is an open-source privacy engineering platform. fides.js, a client-side script used to interact with the consent management features of Fides, used the polyfill.io domain in a very limited edge case, when it detected a legacy browser such as IE11 that did not support the fetch standard...

The vulnerability of the Dawn component in browsers Google Chrome and Microsoft Edge allows a hacker to execute arbitrary code.

The vulnerability of the Dawn component in Google Chrome and Microsoft Edge browsers is related to the use of memory after deallocation. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers allows attackers to execute arbitrary code.

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to type mixing errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created web page...

Cross Site Scripting (XSS)

silverstripe/framework is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper validation allowing users to specify a non-URL malicious script as the redirection path, which executes within the browser when the URL is followed...

CVE-2024-38082

Microsoft Edge Chromium-based Spoofing Vulnerability...

Mozilla: Sandboxed iframes were able to bypass sandbox restrictions to open a new window

The Mozilla Foundation Security Advisory describes this flaw as: By tricking the browser with a X-Frame-Options header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new window...

Google Chrome Browser UI Module Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in the Google Chrome Browser UI module and can be exploited by an attacker to execute arbitrary code on the system...

CVE-2024-5699

In violation of spec, cookie prefixes such as Secure were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive comparison. This could have resulted in the browser not correctly honoring the behaviors specified by the prefix. This...

CVE-2024-5699

In violation of spec, cookie prefixes such as Secure were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive comparison. This could have resulted in the browser not correctly honoring the behaviors specified by the prefix. This...