SUSE CVE-2016-5282

Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by a jar: URL for a favicon resource...

SUSE CVE-2016-5298

A mechanism where disruption of the loading of a new web page can cause the previous page's favicon and SSL indicator to not be reset when the new page is loaded. Note: this issue only affects Firefox for Android. Desktop Firefox is unaffected. This vulnerability affects Firefox 50...

SUSE CVE-2018-11646

webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash...

SUSE CVE-2018-12403

If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not displayed to users. This vulnerability affects Firefox 63...

SUSE CVE-2021-23986

A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The response to this cross-origin request could have been read by the extension, allowing a same-origin policy bypass by the extension, which should not have...

Nextcloud: Ability to control the filename when uploading a logo or favicon on theming

A vulnerability existed in Nextcloud that allowed an attacker to control the filename of a logo or favicon when uploading it, by modifying the key. This could result in the attacker uploading any files directly in the webapp and path disclosure. The vulnerability has been fixed...

CVE-2022-40219

Cross-Site Request Forgery CSRF vulnerability in SedLex FavIcon Switcher plugin = 1.2.11 at WordPress allows plugin settings change...

CVE-2022-40219

Cross-Site Request Forgery CSRF vulnerability in SedLex FavIcon Switcher plugin = 1.2.11 at WordPress allows plugin settings change...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in SedLex FavIcon Switcher plugin = 1.2.11 at WordPress allows plugin settings change...

CVE-2022-40219 WordPress FavIcon Switcher plugin <= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in SedLex FavIcon Switcher plugin = 1.2.11 at WordPress allows plugin settings change...

CVE-2022-40219 WordPress FavIcon Switcher plugin <= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in SedLex FavIcon Switcher plugin = 1.2.11 at WordPress allows plugin settings change...

CVE-2022-40219

CVE-2022-40219 affects the WordPress FavIcon Switcher plugin, {

WordPress FavIcon Switcher plugin <= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability was discovered by Lana Codes Patchstack Alliance in the WordPress FavIcon Switcher plugin versions = 1.2.11. Solution Deactivate and delete. This plugin has been closed as of September 19, 2022 and is not available for download. This closure is...

PT-2022-25290 · Sedlex · Sedlex Favicon Switcher Plugin

Name of the Vulnerable Software and Affected Versions: SedLex FavIcon Switcher plugin versions 1.2.11 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which allows changes to plugin settings. This type of vulnerability enables an attacker to perfor...

WordPress plugin SedLex FavIcon Switcher 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

MAL-2022-5681 Malicious code in react-yandex-favicon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67fbffe869a619ee770b50818e5f42a7e85a7f9e673bb0310f4dc6c0a7d550e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-yandex-favicon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67fbffe869a619ee770b50818e5f42a7e85a7f9e673bb0310f4dc6c0a7d550e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2021-27770

The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this service is used by the “meetings”-function where users can specify an external URL where the online meeting will take place...

HCL Technologies HCL Sametime 安全漏洞

HCL Sametime, a conferencing solution from HCL Technologies, has a security vulnerability in HCL Technologies HCL Sametime version 11.6 that stems from a lack of external URL absorption in FaviconService, which could be exploited by an attacker to specify the external URL where the online meeting...

PT-2022-9858 · Hcl +1 · Sametime

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue was discovered within the FaviconService, which takes a base64-encoded URL and requests it through the webserver. It is assumed that this...