6426 matches found
libreoffice: Insufficient URL encoding flaw in allowed script location check
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...
libreoffice: Unsafe URL assembly flaw in allowed script location check
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...
CVE-2019-13495
In firmware version 4.50 of Zyxel XGS2210-52HP, multiple stored cross-site scripting XSS issues allows remote authenticated users to inject arbitrary web script via an rpSys.html Name or Location field...
CVE-2019-13495
In firmware version 4.50 of Zyxel XGS2210-52HP, multiple stored cross-site scripting XSS issues allows remote authenticated users to inject arbitrary web script via an rpSys.html Name or Location field...
Directory traversal
An issue was discovered in Progress Telerik UI for Silverlight before 2020.1.330. The RadUploadHandler class in RadUpload for Silverlight expects a web request that provides the file location of the uploading file along with a few other parameters. The uploading file location should be inside the...
Debian: Security Advisory (DLA-2162-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
ProjectOpal - Stealth Post-Exploitation Framework For Wordpress
Stealth post-exploitation framework for Wordpress CMS Official ProjectOpal Repository. What is it and why was it made? We intentionally made it for our penetration testing jobs however its getting grey hairs now so we thought we would like to pass it on to the public!. ProjectOpal or Opal. Is a...
CVE-2020-6808
When a JavaScript URL javascript: is evaluated and the result is a string, this string is parsed to create an HTML document, which is then presented. Previously, this document's URL as reported by the document.location property, for example was the originating javascript: URL which could lead to...
npmjs-url-parse: Improper validation of protocol of the returned URL
An input validation flaw exists in the node.js-url-parse, which results in the URL being incorrectly set to the document location protocol instead of the URL being passed as an argument. An attacker could use this flaw to bypass security checks on URLs...
Samsung Mobile Device Information Disclosure Vulnerability (CNVD-2020-32872)
Android is a free and open source operating system from Google based on the Linux kernel without GNU components. Samsung mobile devices have an information disclosure vulnerability that can be exploited by attackers to share location information from a locked screen...
CVE-2019-20579
An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 software. Gallery allows attackers to enable Location information sharing from the lock screen. The Samsung ID is SVE-2019-14462 August 2019...
CVE-2019-20579
An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 software. Gallery allows attackers to enable Location information sharing from the lock screen. The Samsung ID is SVE-2019-14462 August 2019...
Information disclosure
An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 software. Gallery allows attackers to enable Location information sharing from the lock screen. The Samsung ID is SVE-2019-14462 August 2019...
CVE-2019-20579
Samsung reports a vulnerability in the Gallery app on Galaxy devices running N(7.x), O(8.x), and P(9.0) that allows attackers to enable location information sharing from the lock screen. The entry references Samsung ID SVE-2019-14462 (August 2019). No concrete exploit details, affected specific m...
CVE-2020-10800
lix through 15.8.7 allows man-in-the-middle attackers to execute arbitrary code by modifying the HTTP client-server data stream so that the Location header is associated with attacker-controlled executable content in the postDownload field...
CVE-2020-10800
lix through 15.8.7 allows man-in-the-middle attackers to execute arbitrary code by modifying the HTTP client-server data stream so that the Location header is associated with attacker-controlled executable content in the postDownload field...
Canon Oce Colorwave 500 Cross-Site Scripting Vulnerability (CNVD-2020-18989)
The Canon Oce Colorwave 500 is a printer from Canon Japan. A cross-site scripting vulnerability exists in the /TemplateManager/indexExternalLocation.jsp file of the web application in Canon Oce Colorwave 500 version 4.0.0.0. The vulnerability stems from the WEB application lacking proper validati...
Authorities Eye Using Mobile Phone Tracking COVID-19's Spread
Authorities in the United States and Israel are eyeing ways to use mobile-phone and other location-based data to help control the spread of the new coronavirus COVID-19, raising serious privacy concerns about the practice of using and sharing people’s personal data during the time of a global...
Authorities Eye Using Mobile Phone Tracking COVID-19's Spread
Authorities in the United States and Israel are eyeing ways to use mobile-phone and other location-based data to help control the spread of the new coronavirus COVID-19, raising serious privacy concerns about the practice of using and sharing people’s personal data during the time of a global...