Khan Academy: Khan Academy ClickJacking to Steal Users's Credintials

DESCRIPTION 1. It ask to login to https://alerta.khanacademy.org with google account. 2. It doesn't give access to any normal user. 3. That's why after trying to login with GOOGLE account it shows a error message prompt with user's sensitive information including email, code/access token and clie...

Flaw in Zoom Video Conferencing Software Lets Websites Hijack Mac Webcams

If you use Zoom video conferencing software on your Mac computer—then beware—any website you're visiting in your web browser can turn on your device camera without your permission. Ironically, even if you had ever installed the Zoom client on your device and simply uninstalled it, a remote attack...

17-Year-Old Weakness in Firefox Let HTML File Steal Other Files From Device

Except for phishing and scams, downloading an HTML attachment and opening it locally on your browser was never considered as a severe threat until a security researcher today demonstrated a technique that could allow attackers to steal files stored on a victim's computer. Barak Tawily, an...

Microsoft Office 365 (2016 Click-to-Run) Multiple RCE Vulnerabilities (Jun 2019)

This host is missing an important security update according to Microsoft Office Click-to-Run updates. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2019-4217

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, and 1.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch...

CVE-2019-4217: Improper Restriction of Rendered UI Layers or Frames

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, and 1.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch...

WordPress Ad-Manager 1.1.2 Open Redirection

Exploit Title : WordPress Ad-Manager Plugins 1.1.2 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 23/05/2019 Vendor Homepage : wordpress.org Software Information Link : wordpress.org/plugins/ad-manager-wd/ Software Affected Versions : Plugin...

PT-2019-6103

Name of the Vulnerable Software and Affected Versions WhatsApp for Android versions 2.19.134 and earlier WhatsApp Business for Android versions 2.19.44 and earlier WhatsApp for iOS versions 2.19.51 and earlier WhatsApp Business for iOS versions 2.19.51 and earlier WhatsApp for Windows Phone...

CVE-2018-2015

IBM API Connect 2018.1 and 2018.4.1.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks agains...

CVE-2018-2015

IBM API Connect 2018.1 and 2018.4.1.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks agains...

CVE-2018-2015

IBM API Connect 2018.1 and 2018.4.1.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks agains...

PT-2019-10006

Name of the Vulnerable Software and Affected Versions: IBM API Connect versions 2018.1 through 2018.4.1.4 Description: A remote attacker could hijack the clicking action of a victim by persuading them to visit a malicious Web site, potentially launching further attacks against the victim...

CVE-2016-1579 UDM doesn't check for confinement before running post-processing commands

UDM provides support for running commands after a download is completed, this is currently made use of for click package installation. This functionality was not restricted to unconfined applications. Before UDM version 1.2+16.04.20160408-0ubuntu1 any confined application could make use of the UD...

Microsoft Office 365 (2016 Click-to-Run) Multiple RCE Vulnerabilities (Apr 2019)

This host is missing an important security update according to Microsoft Office Click-to-Run updates. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2018-1853

IBM Tivoli Storage Manager IBM Spectrum Protect 7.1 and 8.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch...

Design/Logic Flaw

IBM Tivoli Storage Manager IBM Spectrum Protect 7.1 and 8.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch...

CVE-2018-1853

IBM Tivoli Storage Manager IBM Spectrum Protect 7.1 and 8.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch...

PT-2019-9602

Name of the Vulnerable Software and Affected Versions IBM Tivoli Storage Manager versions 7.1 through 8.1 Description The issue allows a remote attacker to hijack the clicking action of the victim. This can be achieved by persuading a victim to visit a malicious Web site, potentially leading to...

CVE-2018-1853: Improper Restriction of Rendered UI Layers or Frames

IBM Tivoli Storage Manager IBM Spectrum Protect 7.1 and 8.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch...

Design/Logic Flaw

Abine Blur 7.8.2431 allows remote attackers to conduct "Second-Factor Auth Bypass" attacks by using the "Perform a right-click operation to access a forgotten dev menu to insert user passwords that otherwise would require the user to accept a second-factor request in a mobile app." approach,...