Mozilla: Information disclosure due to manipulated URL object

The Mozilla Foundation Security Advisory describes this flaw as: Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript...

Mozilla: Information disclosure due to manipulated URL object

The Mozilla Foundation Security Advisory describes this flaw as: Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript...

Unspecified Vulnerability in Apple macOS Catalina NSURL Component

Apple macOS Catalina is a proprietary operating system developed by Apple for Mac computers, and NSURL is one of the components used to handle URLs Uniform Resource Locators. A security vulnerability exists in the NSURL component in Apple macOS Catalina versions prior to 10.15.5. An attacker coul...

The vulnerability of Google Chrome, related to insufficient filtering in the URL string, allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of Google Chrome is related to insufficient filtering in the URL string. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service interruptions...

D-Link DSL-2640B B2 Buffer Error Vulnerability

The D-Link DSL-2640B B2 is a wireless router from AUO D-Link of Taiwan, China. A buffer error vulnerability exists in the 'docgi' function in the D-Link DSL-2640B B2 EU4.01B version. An attacker can exploit the vulnerability by providing a malicious cgi module name in the URL to execute code with...

The vulnerability of the URL parser component in Google Chrome web browsers allows a hacker to compromise data integrity.

The vulnerability of the URL parser component in Google Chrome exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

Command Injection

Overview op-browser is a module that open browser window and set proxy. Affected versions of this package are vulnerable to Command Injection. The url parameter can be controlled by users without any sanitization. PoC var root = require"op-browser"; root.open'chrome','& touch Song','',''; Details...

5 Best Internet Service Locators

By Waqas By using an internet service locator will allow you to learn about all of your options for service providers before you commit to a company. This is a post from HackRead.com Read the original post: 5 Best Internet Service Locators...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-17368)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflected cross-site scripting vulnerability exists in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language version ...

The vulnerability of Cisco Webex Meetings software-related software lies in its lack of access control mechanisms, which allows attackers to escalate their privileges.

The vulnerability of Cisco Webex Meetings software relates to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to enhance their privileges through specially created URL requests...

DEBIAN-CVE-2019-18862

maidag in GNU Mailutils before 3.8 is installed setuid and allows local privilege escalation in the url mode...

DEBIAN-CVE-2019-9853

LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically execution of macros are blocked by default. A URL decoding flaw existed in how the urls to the macros within the document were processed and categorized, resulting in...

tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources

The URL pattern of "" the empty string which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It...

CVE-2018-4016

An exploitable code execution vulnerability exists in the URL-parsing functionality of the Roav A1 Dashcam running version RoavA1SWV1.9. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability...

Family locator app leaked real-time location data of 238,000 individuals

By Waqas We normally consider family locator app as a blessing because we are able to track our family members conveniently through them. But, what if your private data collected or shared on such an app gets misused by cybercriminals because the app fails to secure it properly? It would instantl...

Location data leaks from family tracking app database

An app called Family Locator, which allows family members to keep track of one another recently experienced an exposed database issue of the worst kind. Specifically: the MongoDB database was left exposed with no password, like so many other recent infosec tales of woe. The end result is the...

Starbucks: Reflected XSS in https://www.starbucks.co.jp/store/search/

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Please indicate NA, if not applicable. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling...

PHP-Proxy Cross-Site Scripting Vulnerability

PHP-Proxy is a web-based proxy script featuring fast, easy customization and the ability to provide support for complex websites such as YouTube and Facebook. A cross-site scripting vulnerability exists in PHP-Proxy versions 5.1.0 and earlier, which can be exploited by an attacker via a URL field...

robinsonsbank.com.ph XSS vulnerability

Open Bug Bounty ID: OBB-681750 Description| Value ---|--- Affected Website:| robinsonsbank.com.ph Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

bodycraft.com XSS vulnerability

Open Bug Bounty ID: OBB-679622 Description| Value ---|--- Affected Website:| bodycraft.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...