23358 matches found
New Chrome Browser 0-day Under Active Attack—Update Immediately!
Google has patched a zero-day vulnerability in Chrome web browser for desktop that it says is being actively exploited in the wild. The company released 88.0.4324.150 for Windows, Mac, and Linux, with a fix for a heap buffer overflow flaw CVE-2021-21148 in its V8 JavaScript rendering engine...
CVE-2020-8294
A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format...
CVE-2020-8294
A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format...
Format string
A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format...
CVE-2020-8294
A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format...
CVE-2020-8294
A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format...
CVE-2020-8294
CVE-2020-8294 in Nextcloud Server is a missing link validation vulnerability that allowed stored XSS via a javascript: URL in markdown. Affected versions are Nextcloud Server before 20.0.2, 19.0.5, and 18.0.11. The issue is fixed in OpenSUSE/OpenSUSE-SU updates (e.g., Nextcloud 20.0.7 and later)....
CVE-2021-22872
Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting XSS vulnerability via the publicly accessible afr.php delivery script. While this issue was previously addressed in modern browsers as CVE-2020-8115, some older browsers e.g., IE10 that do not automatically URL encode...
Reflected XSS when renaming malicious file (NC-SA-2021-005)
Missing sanitization in Nextcloud Server 20.0.5 and prior allowed to perform a reflected XSS when saving html as file name and causing an error on rename e.g. by renaming to an existing file. The risk is mostly mitigated due to the strict Content-Security-Policy CSP of Nextcloud, and thus mainly...
January 12, 2021—KB4598297 (Security-only update)
None None...
Exploit for Type Confusion in Microsoft
https://www.thezdi.com/blog/2019/5/21/rce-without-native-code-ex...
Exploit for Out-of-bounds Write in Microsoft
PoC exploit for CVE-2019-1221 Lost the orig...
December 8, 2020—KB4592495 (Security-only update)
None None...
Digitally Signed Bandook Malware Once Again Targets Multiple Sectors
A cyberespionage group with suspected ties to the Kazakh and Lebanese governments has unleashed a new wave of attacks against a multitude of industries with a retooled version of a 13-year-old backdoor Trojan. Check Point Research called out hackers affiliated with a group named Dark Caracal in a...
Published application launches twice when application clicked only once
When launching a published application through Internet Explorer, the published application starts twice when the application was clicked only once. The first instance will be successful and then wfshell calls another instance of the application...
The vulnerability of the Scripting Engine component in Internet Explorer arises from an operation that goes beyond the buffer boundaries in memory, allowing an attacker to execute arbitrary code.
The vulnerability of the Scripting Engine component in Internet Explorer arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
November 19, 2020—KB4586839 (OS Build 17763.1613) Preview
None None...
Vulnerability of Microsoft Edge and Internet Explorer browsers, caused by the execution of operations beyond the buffer in memory, allowing attackers to execute arbitrary code
The vulnerabilities of Microsoft Edge and Internet Explorer are caused by the execution of an operation outside the buffer in memory. Exploiting these vulnerabilities allows a remote attacker to execute arbitrary code...
The vulnerability in Internet Explorer, caused by an operation that goes beyond the buffer in memory, allows a malicious actor to execute arbitrary code.
The vulnerability of the Internet Explorer browser arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created web page...
Stored XSS in markdown file with Nextcloud Talk using Internet Explorer (NC-SA-2021-002)
A missing link validation in Nextcloud Server 20.0.1 allowed to execute a stored XSS attack on Internet Explorer users by saving a javascript url in a Markdown...