CVE-2026-13461

When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app. The injection of specific JavaScript function calls allows the attacker to escape the WebView sandbox and perform a number of dangerous actions on the user's device...

GHSA-MHC9-48GJ-9GP3 Fickling has safety check bypass via REDUCE+BUILD opcode sequence

Assessment It is believed that the analysis pass works as intended, REDUCE and BUILD are not at fault here. The few potentially unsafe modules have been added to the blocklist https://github.com/trailofbits/fickling/commit/0c4558d950daf70e134090573450ddcedaf10400. Original report Summary All 5 of...

EUVD-2005-2261

Malware in sbrugna...

EUVD-2025-29642

Malicious code in bioql PyPI...

Microsoft Edge Spear Phishing

The vulnerability of Microsoft Edge is related to the absence of warnings about dangerous actions. Exploiting this vulnerability allows a remote attacker to carry out spear-phishing attacks...

XWiki Platform XSS

The vulnerability of the NotificationDisplayerClass class in the XWiki platform, a platform for creating collaborative web applications, is related to the absence of warnings about dangerous actions when loading edited objects. Exploiting this vulnerability could allow attackers to perform XSS...

XWiki Platform Code Execution

The vulnerability of the XWiki Platform lies in the modification of the XClass structure’s properties due to the absence of warnings about dangerous actions. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Microsoft Edge Spear Phishing

The vulnerability of Microsoft Edge is related to the absence of warnings about dangerous actions. Exploiting this vulnerability allows a remote attacker to carry out spear-phishing attacks...

Mozilla Firefox Android Full-screen Spoofing

The vulnerability in the full-screen notification mode of the Mozilla Firefox browser on Android operating systems relates to the absence of warnings about dangerous actions when loading pop-up windows for downloaded files. Exploiting this vulnerability allows a remote attacker to carry out...

Mozilla Firefox Brazzer Code Execution

The vulnerability of Mozilla Firefox’s Brazzer is related to insufficient warnings about dangerous actions. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Mozilla Firefox Code Execution

The vulnerability of the Mozilla Firefox browser is related to insufficient warnings about dangerous actions. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20230919-04

The vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird email client browsers is related to the lack of a warning when opening Diagcab files. Exploitation of the vulnerability could allow an attacker to perform a spoofing attack. a spoofing attack. The vulnerability in Mozilla Thunderbi...

Mozilla Firefox Thunderbird Warning

The vulnerabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are related to insufficient warnings about dangerous actions. Exploiting these vulnerabilities allows a remote attacker to upload arbitrary files...

Mozilla Thunderbird Spamming

The vulnerability of Mozilla Thunderbird’s email client is related to insufficient warnings about dangerous actions. Exploiting this vulnerability could allow a malicious actor to perform a spamming attack remotely...

AVEVA Edge Script Creation Code Execution

The vulnerability of the SCADA system AVEVA Edge’s script creation function is related to insufficient warnings about dangerous actions. Exploiting this vulnerability allows a perpetrator to execute arbitrary codes...

Mozilla Firefox Insufficient Warnings Spear Phishing

The vulnerability of the Mozilla Firefox browser is related to insufficient warnings about dangerous actions. Exploiting this vulnerability allows a remote attacker to perform a spear-phishing attack...

Mozilla Firefox Insufficient Warnings

The vulnerability of the Mozilla Firefox browser is related to insufficient warnings about dangerous actions. Exploiting this vulnerability allows a remote attacker to carry out an attack using a spearphishing technique by replacing the user’s browser interface...

Zomato: Amazon S3 bucket misconfiguration (share)

Hi, Description I have discovered one of your Amazon S3 bucket and tested it via the AWS command line tool on Linux. It looks like permissions are not well configured and allow dangerous actions to everyone. The vulnerable bucket is: zomato-share PoC: aws s3 ls s3://zomato-share aws s3 cp test...

DSA-810-1 mozilla - several

Bulletin has no description...

security flaw

The browser user interface in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 does not properly distinguish between user-generated events and untrusted synthetic events, which makes it easier for remote attackers to perform dangerous actions that normally could only be...