Mozilla: iframe contents could be rendered outside the border

The Mozilla Foundation Security Advisory describes this flaw as: Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks...

Mozilla: iframe contents could be rendered outside the border

The Mozilla Foundation Security Advisory describes this flaw as: Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks...

Mozilla: iframe contents could be rendered outside the border

The Mozilla Foundation Security Advisory describes this flaw as: Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks...

Cockpit 安全漏洞

Cockpit is an interactive server management interface. a security vulnerability exists in Cockpit, which stems from another website within the ＜iFrame＞ HTML entry rendering pages from the cockpit server that could be used by malicious websites for clickjacking or similar attacks. No detailed...

PT-2022-28878

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.5 Description The issue concerns a NULL pointer dereference when converting from inline format. This problem was introduced in version v4.2 and is fixed in Linux Kernel version v5.16.5. The actual impact an...

GSD-2022-1000183 udf: Fix NULL ptr deref when converting from inline format

udf: Fix NULL ptr deref when converting from inline format This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.96 by commit...

GSD-2022-1000148 udf: Fix NULL ptr deref when converting from inline format

udf: Fix NULL ptr deref when converting from inline format This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.176 by commit...

PT-2022-28375

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.265 Description The issue concerns a NULL pointer dereference when converting from inline format. This problem was introduced in version v4.2 and is fixed in Linux Kernel version v4.14.265. The actual impac...

PT-2022-28520

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.19 Description The issue concerns a NULL pointer dereference when converting from inline format. This problem was introduced in version v4.2 and is fixed in Linux Kernel version v5.15.19. The actual impact...

PT-2022-28461

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.96 Description The issue is related to a NULL pointer dereference when converting from inline format. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2022-28357

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.300 Description The issue concerns a NULL pointer dereference when converting from inline format. This problem was introduced in version v4.2 and is fixed in Linux Kernel version v4.9.300. The actual impact...

PT-2022-28399

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.228 Description The issue is related to a NULL pointer dereference when converting from inline format. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2022-28426

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.176 Description The issue concerns a NULL pointer dereference when converting from an inline format. This problem was introduced in version v4.2 and is fixed in version v5.4.176. The actual impact and attack...

Cross-site Scripting in markdown-it-highlightjs

This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. js const markdownItHighlightjs = require"markdown-it-highlightjs"; const md = require'markdown-it'; const...

GHSA-F246-XRRJ-G8J6 Cross-site Scripting in markdown-it-highlightjs

This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. js const markdownItHighlightjs = require"markdown-it-highlightjs"; const md = require'markdown-it'; const...

Rocky Linux 8 : firefox (RLSA-2021:3157)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:3157 advisory. - Uninitialized memory in a canvas object could have caused an incorrect free leading to memory corruption and a potentially exploitable crash. This...

PT-2022-15719

Name of the Vulnerable Software and Affected Versions Jerryscript version 3.0.0 Description A SEGV issue was discovered in Jerryscript via the ecma ref object inline function in /jerry-core/ecma/base/ecma-gc.c. Recommendations For Jerryscript version 3.0.0, consider restricting access to the ecma...

GHSA-5V2H-R2CX-5XGJ Inefficient Regular Expression Complexity in marked

Impact What kind of vulnerability is it? Denial of service. The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings. PoC is the following. javascript import as marked from 'marked'; console.logmarked.parsex: x \\; Who is impacted? Anyone who runs...

PT-2022-7077

Name of the Vulnerable Software and Affected Versions Marked versions prior to 4.0.10 Description The issue is related to a denial of service caused by the regular expression inline.reflinkSearch potentially leading to catastrophic backtracking against some strings. This can affect anyone who run...

Mozilla: Browser window spoof using fullscreen mode

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: When navigating from inside an iframe while requesting full screen access, an attacker-controlled tab could have made the browser unable to leave full screen mode...