External Links in New Window / New Tab < 1.43 - Tabnabbing

The plugin does not ensure window.opener is set to "null" when links to external sites are clicked, which may enable tabnabbing attacks to occur. Create an external link, check window.opener in the newly opened tab after clicking the external link...

External Links in New Window / New Tab < 1.43 - Unauthenticated Stored Cross-Site Scripting

The plugin does not properly escape URLs it concatenates to onclick event handlers, which makes Stored Cross-Site Scripting attacks possible. On any post on the affected site, add the following link to a comment: Click here for XSS Click on the link, you should be getting an alert box...

External Links in New Window / New Tab < 1.43 - Tabnabbing

The plugin does not ensure window.opener is set to "null" when links to external sites are clicked, which may enable tabnabbing attacks to occur. PoC Create an external link, check window.opener in the newly opened tab after clicking the external link...

WordPress External Links in New Window / New Tab plugin <= 1.42 - Tabnabbing vulnerability

Tabnabbing vulnerability discovered by Daniel Ruf in WordPress External Links in New Window / New Tab plugin versions = 1.42. Solution Update the WordPress External Links in New Window / New Tab plugin to the latest available version at least 1.43...

The vulnerability of the Glances monitoring tool arises from improper restrictions on XML links to external objects. This allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Glances monitoring tool is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability allows a remote attacker to access confidential data, compromise its integrity, and cause service failures...

CVE-2022-22265

creationtimestamp| type| source ---|---|--- 2022-01-10 16:21:00+00:00| seen| https://t.me/cibsecurity/35164 2023-04-05 19:13:57+00:00| exploited| Telegram/b6MdP9MboN1sYxosDv05uyHi0qJf7CBXiU17JbE-8yXOq2Q 2023-09-18 18:10:02+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-09-21...

The vulnerability in the web interface of the Cisco Identity Services Engine, which allows a perpetrator to perform an SSRF attack

The vulnerability in the web interface of the Cisco Identity Services Engine relates to incorrect restrictions on XML links to external objects. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack remotely...

MP3 Audio Player for Music, Radio & Podcast by Sonaar < 2.4.2 - Multiple Admin+ Cross Site Scripting

The plugin does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks 1 Add playlist with "Optional Call to Action"'s "Label" set to: " style="animation-name:twentytwentyone-close-button-transition"...

HackerOne: Disclosure handle private program with external link

Summary: Hi team. It looks like we can identify private programs that have an external link Steps To Reproduce 1. http POST /graphql HTTP/1.1 Host: hackerone.com Connection: close Content-Length: 168 accept: / X-Auth-Token: yourtoken User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64...

CVE-2021-31216

Siren Investigate before 11.1.1 contains a server side request forgery SSRF defect in the built-in image proxy route which is enabled by default. An attacker with access to the Investigate installation can specify an arbitrary URL in the parameters of the image proxy route and fetch external URLs...

Unspecified Vulnerability in Rocket.Chat

Rocket.Chat is an open source team chat software. A security vulnerability exists in the Rocket.Chat desktop application version 2.17.11, which originates from the ability to open external links without user interaction. No details of the vulnerability are available at this time...

CVE-2020-26763

The Rocket.Chat desktop application 2.17.11 opens external links without user interaction...

CVE-2020-26763

The Rocket.Chat desktop application 2.17.11 opens external links without user interaction...

Design/Logic Flaw

The Rocket.Chat desktop application 2.17.11 opens external links without user interaction...

CVE-2020-26763

The Rocket.Chat desktop application 2.17.11 opens external links without user interaction...

Rocket.Chat 安全漏洞

Rocket.Chat is an open source team chat software. A security vulnerability exists in the Rocket.Chat desktop application version 2.17.11, which originates from the ability to open external links without user interaction. No details of the vulnerability are available at this time...

The vulnerability of the cryptobiblioteca xmlsec, related to an incorrect limitation on XML links to external objects, allows a violator to compromise the confidentiality and accessibility of the protected information.

The vulnerability of the xmlsec cryptobibliothek is related to an incorrect limitation on XML links to external objects. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and accessibility of the protected information...

PT-2021-17758 · Apache · Apache Superset

Name of the Vulnerable Software and Affected Versions: Apache Superset versions prior to 1.1.0 Description: The issue allows for the creation of an external URL that could be malicious. By not checking user input for open redirects, the URL shortener functionality would allow for a malicious user...

The vulnerability of the Windows Media Center multimedia playback application stems from incorrect restrictions on XML links to external objects, which allows attackers to exploit this flaw to disclose protected information.

The vulnerability of the Windows Media Center multimedia playback application is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability could allow a malicious actor to disclose protected information using a specially crafted .mcl file...

The vulnerability in the vManage web interface of the software-defined Cisco SD-WAN network allows a malicious actor to gain unauthorized access to protected information and to modify, add, or delete data.

The vulnerability in the vManage web interface of the Cisco SD-WAN program-defined network is related to errors in restricting XML links to external objects. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information and to modify, add, or delete data...