26494 matches found
Stripo Inc: csrf bypass using flash file + 307 redirect method at plugins endpoint
Hi Security team, i have found that the request sent to https://my.stripo.email/cabinet/stripeapi/v1/plugin/$userid$/plugins don't have any protection against csrf attacks as the server only validates that the content type is application/json and this can be bypassed using the flash file + 307...
Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking
A recent report identified 19+ vulnerabilities that should be mitigated by end of year 2019. These are a range of top vulnerabilities attacked and leveraged by Advance Persistent Threat APT actors from all parts of the world. The list below shows those top 19 vulnerabilities, and it should be no...
CVE-2013-4692
Xorbin Analog Flash Clock 1.0 extension for Joomia has XSS...
CVE-2013-4693
WordPress Xorbin Digital Flash Clock 1.0 has XSS...
Cross site scripting
WordPress Xorbin Digital Flash Clock 1.0 has XSS...
CVE-2013-4692
Xorbin Analog Flash Clock 1.0 extension for Joomia has XSS...
CVE-2013-4692
CVE-2013-4692 corresponds to a cross-site scripting vulnerability in the Xorbin Analog Flash Clock extension for Joomla and related WordPress/XORBin clocks. The root cause is unsanitized input in the widgetUrl/urlWindow parameters from external input, enabling user-controllable script execution i...
CVE-2013-4693
WordPress Xorbin Digital Flash Clock 1.0 has XSS...
CVE-2013-4693
CVE-2013-4693 affects the WordPress plugin Xorbin Digital Flash Clock 1.0. The vulnerability is a Flash-based XSS in the plugin’s frontend due to the xorDigitalClock.swf component, where the external input taken from the widgetUrl parameter is passed into getURL. This causes injected script execu...
PT-2019-6965
Name of the Vulnerable Software and Affected Versions Xorbin Analog Flash Clock extension for Joomia version 1.0 Description The issue is related to a XSS problem in the Xorbin Analog Flash Clock 1.0 extension for Joomia. No information is provided about the estimated number of potentially affect...
PT-2019-6966
Name of the Vulnerable Software and Affected Versions WordPress Xorbin Digital Flash Clock version 1.0 Description The issue is related to a Cross-Site Scripting XSS problem. XSS is a type of security vulnerability that allows an attacker to inject malicious scripts into a website, potentially...
CVE-2013-4693: Improper Neutralization of Input During Web Page Generation
WordPress Xorbin Digital Flash Clock 1.0 has XSS...
CVE-2013-4692: Improper Neutralization of Input During Web Page Generation
Xorbin Analog Flash Clock 1.0 extension for Joomia has XSS...
VulnCheck KEV: CVE-2014-0498
Stack-based buffer overflow in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows...
Barco ClickShare Button R9861500D01 Input Validation Error Vulnerability
The Barco ClickShare Button R9861500D01 is a wireless control device for presentation systems from Barco Belgium. A security vulnerability exists in Barco ClickShare Button R9861500D01 prior to version 1.9.0, which originates from the program failing to perform an integrity check on variable...
Integer Overflow Vulnerability in Xiaomi Browser
Xiaomi Browser is a browser that comes randomly with Xiaomi phones. Xiaomi Browser suffers from an integer overflow vulnerability that can be exploited by attackers to cause the browser to crash and flash...
Flash Player Use-After-Free
The vulnerability of the Flash Player software platform is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Threat Analysis Unit (TAU) Threat Intelligence Notification: CrescentCore (macOS)
In June of 2019, researchers at Intego discovered a new Trojan for macOS systems which they named CrescentCore. Much like Shlayer and other common malware targeting macOS systems, CrescentCore is often delivered via a fake Adobe Flash Player installer or updater. This malware employs multiple...
CVE-2019-19815
A NULL pointer dereference flaw was found in F2FSPSB in fs/f2fs/f2fs.h in the F2FS filesystem exploiting the NAND flash memory-based storage device. This flaw allows an attacker to crash the system or leak internal kernel information. Mitigation Mitigation for this issue is either not available o...
UBUNTU-CVE-2019-19814
In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause removedirtysegment slab-out-of-bounds write access because an array is bounded by the number of dirty types 8 but the array index can exceed this...