2677 matches found
Western Digital My Cloud Multiple Products < 2.12.127 / 2.20 - 2.30 < 2.31.149 Multiple Vulnerabilities
Multiple Western Digital My Cloud products are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
The vulnerability of the Click-to-Run components of Microsoft Office and Office 365, related to memory object processing errors, allows attackers to escalate their privileges.
The vulnerability of the Click-to-Run components of Microsoft Office and Office 365 is related to errors in memory object handling. Exploiting this vulnerability can allow a remote attacker to gain elevated privileges using a specially crafted file...
TikTok: Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data Exfiltration
The researcher discovered a URL parameter reflecting its value without being properly sanitized and was able to achieve reflected XSS. In addition, researcher found an endpoint which was vulnerable to CSRF. The endpoint allowed to set a new password on accounts which had used third-party apps to...
Exploit for Insecure Storage of Sensitive Information in Microsoft
CVE-2020-1493 This vulnerability occurs in Outlook 2019 16.0...
CVE-2020-4165
IBM Security Guardium Insights 2.0.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against...
CVE-2020-4165
IBM Security Guardium Insights 2.0.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against...
Click to Top < 1.2.8 - Authenticated Stored Cross-Site Scripting
The Type scroll text field in the plugin settings page was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the changes. It is triggered when a user loads any page on the website. All WordPress websites using Click to top WordPress Plugin...
Click to Top < 1.2.8 - Authenticated Stored Cross-Site Scripting
The Type scroll text field in the plugin settings page was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the changes. It is triggered when a user loads any page on the website. All WordPress websites using Click to top WordPress Plugin...
WordPress Click to Top plugin <= 1.2.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability found by Melbin K Matthew in WordPress Click to Top plugin versions = 1.2.5. Solution Update the WordPress Click to Top plugin to the latest available version at least 1.2.8...
WordPress Click To Top 1.2.7 Persistent Cross Site Scripting
Exploit Title: WordPress Click to top Plugin v1.2.7 - Persistent Cross-Site Scripting Date: 2020-08-18 Vendor Homepage: http://wpthemespace.com/ Vendor Changelog: https://wordpress.org/plugins/click-to-top/ Exploit Author: Melbin K Mathew @melbinkm Author Advisory:...
CVE-2020-1581
An elevation of privilege vulnerability exists in the way that Microsoft Office Click-to-Run C2R components handle objects in memory. An attacker who successfully exploited the vulnerability could elevate privileges. The attacker would need to already have the ability to execute code on the syste...
CVE-2020-1581
An elevation of privilege vulnerability exists in the way that Microsoft Office Click-to-Run C2R components handle objects in memory. An attacker who successfully exploited the vulnerability could elevate privileges. The attacker would need to already have the ability to execute code on the syste...
CVE-2020-1581 Microsoft Office Click-to-Run Elevation of Privilege Vulnerability
...
CVE-2020-1581
CVE-2020-1581 is an elevation of privilege vulnerability in Microsoft Office Click-to-Run (C2R). The issue stems from how C2R components handle objects in memory, enabling an attacker who already has code execution rights to elevate privileges by running a specially crafted application. The offic...
Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Aug 2020)
This host is missing a critical security update according to Microsoft Office Click-to-Run updates. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
Microsoft Office Click-to-Run Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in the way that Microsoft Office Click-to-Run C2R components handle objects in memory. An attacker who successfully exploited the vulnerability could elevate privileges. The attacker would need to already have the ability to execute code on the syste...
Black Hat 2020: 'Zero-Click' MacOS Exploit Chain Uses Microsoft Office Macros
A new “zero-click” MacOS exploit chain could allow attackers to deliver malware to MacOS users using a Microsoft Office document with macros. The attack bypasses security measures that both Microsoft and Apple have put in place to protect MacOS users from malicious macros. The exploit chain,...
CVE-2020-4644
IBM Planning Analytics Local 2.0.0 through 2.0.9.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...
CVE-2020-4644
IBM Planning Analytics Local 2.0.0 through 2.0.9.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...