Ubuntu 18.04 LTS : WebKitGTK+ vulnerability (USN-4331-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4331-1 advisory. A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote...

Cross-Site Request Forgery (CSRF)

@fraction/oasis is vulnerable to cross-site request forgery CSRF. An attacker is able to submit requests to the vulnerable application on behalf of a user who visits a malicious website...

GHSA-J438-45HC-VJHM CSRF and DNS Rebinding in Oasis

Impact What kind of vulnerability is it? Who is impacted? If you're running a vulnerable application on your computer and an attacker can trick you into visiting a malicious website, they could use DNS rebinding and CSRF attacks to read/write to vulnerable applications. There is no evidence that...

Oasis Cross-Site Request Forgery Vulnerability

Oasis is an open source peer-to-peer social application. A cross-site request forgery vulnerability exists in Oasis versions prior to 2.15.0. An attacker can exploit this vulnerability to read or write to vulnerable applications with the help of a specially crafted malicious website...

MS16-015: Description of the security update for SharePoint Foundation 2013: February 9, 2016

MS16-015: Description of the security update for SharePoint Foundation 2013: February 9, 2016 Summary This security update resolves vulnerabilities in Microsoft SharePoint that could allow escalation of privilege if a user browses to a malicious website. To learn more about these vulnerabilities,...

Spoofing Attack

firefox is vulnerable to spoofing attack. A flaw was found in the way Firefox presented the location bar to users. A malicious website could trick a user into thinking they are visiting the site reported by the location bar, when the page is actually content controlled by an attacker...

Arbitrary Code Execution

firefox is vulnerable to arbitrary code execution. It was found that the fix for CVE-2010-0179 was incomplete when the Firebug add-on was used. If a user visited a website containing malicious JavaScript while the Firebug add-on was enabled, it could cause Firefox to execute arbitrary JavaScript...

Authorization Bypass

firefox is vulnerable to authorization bypass. The vulnerability exists as a flaw was found in the way Firefox presented the location bar to a user. A malicious website could trick a user into thinking they are visiting the site reported by the location bar, when the page is actually content...

Arbitrary Code Execution

firefox is vulnerable to arbitrary code execution. An integer overflow flaw was found in the way Firefox displayed certain web content. A malicious web site could cause Firefox to crash, or execute arbitrary code with the permissions of the user running Firefox...

Privilege Escalation

seamonkey is vulnerable to privilege escalation. The vulnerability exists if a user saves login information for a malicious website, it could be possible to corrupt the password database, preventing the user from properly accessing saved password data...

Information Disclosure

seamonkey is vulnerable to information disclosure. The vulnerability exists if a user has certain extensions installed, it could allow a malicious website to steal sensitive session data. Note: this flaw does not affect a default installation of SeaMonkey...

Phishing Attacks

kdebase is vulnerable to phishing attacks. The vulnerability exists as it was possible for a malicious website to cause the Konqueror address bar to display information which could trick a user into believing they are at a different website than they actually are...

Acronis: Content Spoofing

Vulnerability: Content Spoofing or Text Injection Description: This vulnerability will reflect text on to the web page which is used to scam a victim to visit or send information to a malicious website. Because it is inside the domain and trusted web page, there is chances of scam. Open the Url a...

CVE-2019-8503

A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. A malicious website may be able to execute scripts in the context of another website...

U.S. Dept Of Defense: Second Order XSS via █████

Summary: A malicious user can use HTML injection to send a malicious chat message to an unsuspecting user, leading to a second order HTML injection/XSS via e-mail. Description: This will send an e-mail to the user that they have received a new message, and the malicious message will be sent to th...

Unspecified Vulnerability in ABB eSOMS

ABB eSOMS Electronic Shift Operations Management System is a plant operations management system from ABB Switzerland. ABB eSOMS contains a security vulnerability that could be exploited by an attacker to compromise sensitive user information by framing parts of the application on a malicious...

Design/Logic Flaw

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 13.0.5. Visiting a malicious website may lead to address bar spoofing...

Denial of service

A denial of service issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. A malicious website may be able to cause a denial of service...

CVE-2020-3862

A denial of service issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. A malicious website may be able to cause a denial of service...

CVE-2019-4595

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displaye...