U.S. Dept Of Defense: Bypassed a fix to gain access to PII of more than 100 Officers

Summary: Hey team I hope this report finds you well and you're having a great day in these difficult times ; While doing my Recon I have found out that https://www.███/ is leaking PII of many Officers Severity according to me- Critical Step-by-step Reproduction Instructions 1. Go to...

Edgeworkers Use Story: Creating High-Performing, Individualized Campaign Responses in Online Retail

As campaigns and digital experiences become more individualized, they can create a challenge for delivering content to consumers at the highest velocity. Having each paid search, social media, and email marketing campaign add unique query string parameters to requests is critical for tracking the...

CVE-2020-4687

IBM Content Navigator 3.0.7 and 3.0.8 could allow an authenticated user to view cached content of another user that they should not have access to. IBM X-Force ID: 186679...

CVE-2020-4687

IBM Content Navigator 3.0.7 and 3.0.8 could allow an authenticated user to view cached content of another user that they should not have access to. IBM X-Force ID: 186679...

Code injection

IBM Content Navigator 3.0.7 and 3.0.8 could allow an authenticated user to view cached content of another user that they should not have access to. IBM X-Force ID: 186679...

CVE-2020-4687

IBM Content Navigator 3.0.7 and 3.0.8 could allow an authenticated user to view cached content of another user that they should not have access to. IBM X-Force ID: 186679...

IBM Content Navigator Information Disclosure Vulnerability (CNVD-2020-47547)

IBM Content Navigator is a Web client from IBM USA. The product supports searching and processing documents stored in content servers from a Web browser. A security vulnerability exists in IBM Content Navigator version 3.0CD. The vulnerability can be exploited by an attacker to illegally view oth...

A padlock problem

There's a difference between what the browser 🔒 means to users, vs what it means to browsers. To users, it means "the page is secure", but to the browser: The certificate dialog in Chrome …it means the "connection" is secure. This is because the security check happens as part of setting up the...

Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images

A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a canvas element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This...

Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images

A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a canvas element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This...

Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images

A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a canvas element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This...

UBUNTU-CVE-2019-11742

A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a canvas element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This...

After Installing Update 3, Enterprise Manager GUI shows Blank

Challenge After installing Veeam 9.5 Update 3 for Enterprise Manager, the GUI shows as blank and many buttons are also missing, such as adding a Veeam Server, or starting a collection task for the Veeam server. Reference Photo of Behavior: Cause This is a browser-related problem and is likely due...

CVE-2016-1381

Memory leak in Cisco AsyncOS 8.5 through 9.0 before 9.0.1-162 on Web Security Appliance WSA devices allows remote attackers to cause a denial of service memory consumption via an HTTP file-range request for cached content, aka Bug ID CSCuw97270...

CVE-2016-1381

Memory leak in Cisco AsyncOS 8.5 through 9.0 before 9.0.1-162 on Web Security Appliance WSA devices allows remote attackers to cause a denial of service memory consumption via an HTTP file-range request for cached content, aka Bug ID CSCuw97270...

Launching ServiceWorker without breaking the web

Update: Thanks to everyone who read and commented, you influenced the direction of the API. We're going for B, the path-based method, but allowing a header to relax these rules so you can put your worker script wherever you want. Many thanks! With ServiceWorkers you can control requests to any pa...

PHP Handicapper Process_signup.PHP HTTP Response Splitting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/15301/info PHP Handicapper is vulnerable to an HTTP response splitting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. A remote attacker may exploit this...

Authentication flaw

The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0, when sliding expiry is enabled, does not properly handle cached content, which allows remote attackers to obtain access to arbitrary user accounts via a crafted URL, ak...

MS11-100: Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (2638420)

The remote Windows host is running a version of the Microsoft ASP.NET Framework that has multiple vulnerabilities. These include: - A flaw exists in the way ASP.NET generates hash tables for user-supplied values. By sending a small number of specially crafted posts to an ASP.NET server, an attack...

CVE-2010-3348

Microsoft Internet Explorer 6, 7, and 8 does not prevent rendering of cached content as HTML, which allows remote attackers to access content from a different 1 domain or 2 zone via unspecified script code, aka "Cross-Domain Information Disclosure Vulnerability," a different vulnerability than...