Multiple access restriction bypass vulnerabilities in UNIQLO App

Overview UNIQLO App provided by UNIQLO CO., LTD. contains multiple access restriction bypass vulnerabilities below. A remote attacker may be able to lead a user to access an arbitrary website via the vulnerable App. The App launched by a Custom URL Scheme may lead a user to access an arbitrary UR...

CVE-2020-13865

The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes...

CVE-2020-13865

The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes...

CVE-2020-13865

The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes...

PT-2020-13739

Name of the Vulnerable Software and Affected Versions Elementor Page Builder plugin versions prior to 2.9.9 Description The issue allows an author user to create posts that result in stored XSS vulnerabilities. This can be achieved by using a crafted link in the custom URL or by applying custom...

CVE-2020-13865: Improper Neutralization of Input During Web Page Generation

The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes...

CVE-2020-5273

In PrestaShop module pslinklist versions before 3.1.0, there is a stored XSS when using custom URLs. The problem is fixed in version 3.1.0...

Design/Logic Flaw

Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via addqueryarg and removequeryarg...

CVE-2015-9366

CVE-2015-9366 affects the Custom URL Tracking Add-on for iThemes Exchange (WordPress) prior to version 1.1.0. The vulnerability is an XSS via add_query_arg() and remove_query_arg(). The NVD data lists CVSSv2 base score 4.3 (MEDIUM) with I:P and A:N, and CVSSv3 base score 6.1 (MEDIUM) with I:L, C:...

PT-2019-7325

Name of the Vulnerable Software and Affected Versions Custom URL Tracking Add-on for iThemes Exchange version 1.1.0 and earlier Description The issue concerns a problem with Custom URL Tracking Add-on for iThemes Exchange, where there is a potential for XSS attacks. This is due to the use of add...

CVE-2015-9366: Improper Neutralization of Input During Web Page Generation

Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via addqueryarg and removequeryarg...

iOS URL Scheme Could Let App-in-the-Middle Attackers Hijack Your Accounts

Security researchers have illustrated a new app-in-the-middle attack that could allow a malicious app installed on your iOS device to steal sensitive information from other apps by exploiting certain implementations of Custom URL Scheme. By default on Apple's iOS operating system, every app runs...

openSUSE Security Update : python-Django (openSUSE-2019-614)

This update for python-Django to version 2.08 fixes the following issues : The following security vulnerability was fixed : - CVE-2018-14574: Fixed an redirection vulnerability in CommonMiddleware boo1102680 The following other bugs were fixed : - Fixed a regression in Django 2.0.7 that broke the...

CVE-2017-0911

Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the "Login with Twitter" component allowing an attacker to provide alternate credentials. In the final step of "Login with Twitter" authentication information is passed back to the application using the...

CVE-2017-0911: Trust of System Event Data

Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the "Login with Twitter" component allowing an attacker to provide alternate credentials. In the final step of "Login with Twitter" authentication information is passed back to the application using the...

PT-2018-5138

Name of the Vulnerable Software and Affected Versions Twitter Kit for iOS versions 3.0 through 3.2.1 Description The issue concerns a callback verification flaw in the "Login with Twitter" component, allowing an attacker to provide alternate credentials. During the "Login with Twitter"...

Design/Logic Flaw

An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to...

CVE-2017-7090

An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to...

UBUNTU-CVE-2017-7090

An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to...

Fedora 23 : drupal7-views (2016-ed5f606dde)

Fixes Views - Less Critical - Access Bypass - SA-CONTRIB-2016-036 Changes since 7.x-3.13 : - Adding field handlers for statistics fields - \2200309 by helmo: Changed invalid placeholder from 'handler' to 'extender'. - \2708535 by stefan.r: Allow users to sort on a specific language, showing it...