CVE-2018-5142

Technical details are not publicly provided in the provided documents. The vulnerability concerns Firefox before 59 and Media Capture and Streams API permission notifications, but no concrete exploit/vector/fix details are included here. Monitor for updates.

CVE-2017-5382

Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for the exposure of internal information not meant to be seen by web content. This vulnerability affects Firefox 51...

CVE-2018-5109

CVE-2018-5109 : Firefox before 58 is vulnerable where an audio capture prompt can incorrectly display the origin. This can mislead users about which site requested audio capture. Affected: Firefox

CVE-2018-5109

An audio capture session can started under an incorrect origin from the site making the capture request. Users are still prompted to allow the request but the prompt can display the wrong origin, leading to user confusion about which site is making the request to capture an audio stream. This...

CVE-2017-5382

CVE-2017-5382 affects Mozilla Firefox prior to 51.0. The feed preview for RSS feeds can expose internal errors/exceptions generated by privileged content, potentially revealing sensitive information. Rationale: described in the CVE entry and corroborated by multiple advisories (OpenSUSE/Mageia/Ub...

CVE-2018-5109

An audio capture session can started under an incorrect origin from the site making the capture request. Users are still prompted to allow the request but the prompt can display the wrong origin, leading to user confusion about which site is making the request to capture an audio stream. This...

CVE-2018-5142

If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not properly display the originating domain. The notification states "Unknown protocol" as the requestee, leading to user confusion about which site is asking for...

CloudBees Jenkins GitHub Plugin Information Disclosure Vulnerability

CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . GitHub Plugin is used in one of the...

CVE-2018-1000183

A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubServerConfig.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing...

CVE-2018-1000183

A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubServerConfig.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing...

CVE-2018-1000186

A exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin 1.41.0 and older in GhprbGitHubAuth.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another...

CSS Keylogger - Chrome Extension And Express Server That Exploits Keylogging Abilities Of CSS

Chrome extension and Express server that exploits keylogging abilities of CSS. To use SetupChrome extension 1. Download repository git clone https://github.com/maxchehab/CSS-Keylogging 2. Visit chrome://extensions in your browser or open up the Chrome menu by clicking the icon to the far right of...

CSRF vulnerability and missing permission checks in Black Duck Detect Plugin allowed server-side request forgery, capturing credentials

Black Duck Detect Plugin did not perform permission checks on methods implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored...

CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials

GitHub Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkin...

Kangaroo Life App has a Bursting Vulnerability

Kangaroo Life App is a mobile lending software. Kangaroo Life APP has a blasting vulnerability. Attackers can log in to any account by grabbing packets and blasting CAPTCHA...

Arbitrary User Registration Vulnerability in Small Objects App

Small Object APP is a dating software based on mobile internet and big data matching. There is an arbitrary user registration vulnerability in Small Object APP. Attackers can register any account by grabbing packets and blasting the verification code...

Security update for wireshark (moderate)

This update for wireshark fixes the following issues: Minor vulnerabilities that could be used to trigger dissector crashes or cause excessive memory use by making Wireshark read specially crafted packages from the network or capture files boo1094301: - CVE-2018-11356: DNS dissector crash -...

Airpydump - Analyze Wireless Packets On The Fly. Currently Supporting Three Working Modes (Reader, Live, Stealth)

Analyze Wireless Packets on the fly. Currently supporting three working Modes Reader, Live, Stealth Description airpydump is a wireless packet analyzer, providing the interface most likely that of airodump-ng from aircrack suite. It currently provides three working modes which are Reader, Stealth...

Peanut Metro WIFI APP has logic design flaws

Peanut Metro WIFI APP is a free wifi software for metro launched by Peanut Technology. There is a logical design vulnerability in Peanut Metro WIFI APP. Attackers can reset any password by forgetting the password function and utilizing packet capture and blasting to obtain the verification code...

CVE-2018-8860

The CVE affects Vecna VGo Robot—versions 3.0.3.52164 and 3.0.3.53662 (earlier versions may also be affected). The flaw enables an attacker on an adjacent network to capture firmware updates, exposing sensitive information and potentially enabling further compromise. The NVD/ICSA data record a CVS...