Security Vulnerabilities fixed in Firefox ESR 102.14 — Mozilla

Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy. In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect...

Malicious code in @ms-atlas/datastudio-diagnostics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a3f339799f51093d5209c8cdce0977b24869016867c813f0abcfc5143e81f921 The OpenSSF Package Analysis project identified '@ms-atlas/datastudio-diagnostics' @ 0.2.10 npm as malicious. It is considered malicious because...

Mallox Ransomware Exploits Weak MS-SQL Servers to Breach Networks

Mallox ransomware activities in 2023 have witnessed a 174% increase when compared to the previous year, new findings from Palo Alto Networks Unit 42 reveal. "Mallox ransomware, like many other ransomware threat actors, follows the double extortion trend: stealing data before encrypting an...

CVE-2023-22037

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite component: MS Excel Specific. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Orac...

Design/Logic Flaw

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite component: MS Excel Specific. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Orac...

ms-lipova-capka.cz Cross Site Scripting vulnerability OBB-3507623

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-32214

Protocol handlers ms-cxh and ms-cxh-full could have been leveraged to trigger a denial of service. Note: This attack only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox 113, Firefox ESR 102.11, and Thunderbird 102.11...

CVE-2023-32214

CVE-2023-32214 affects Mozilla Firefox and Thunderbird on Windows. The vulnerability involves protocol handlers ms-cxh and ms-cxh-full that could be leveraged to trigger a denial of service. Affected versions are Firefox < 113, Firefox ESR < 102.11, and Thunderbird

CVE-2023-32214

Protocol handlers ms-cxh and ms-cxh-full could have been leveraged to trigger a denial of service. Note: This attack only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox 113, Firefox ESR 102.11, and Thunderbird 102.11...

The vulnerability of the SIP ALG firewall on Juniper Networks Junos operating systems on devices with MS-MPC or MS-MIC interfaces allows a attacker to cause a service failure.

The vulnerability of the SIP ALG server on Juniper Networks’ Junos operating system on devices with MS-MPC or MS-MIC interfaces is related to incorrect handling of requests. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in dev.Xiligroup.Com - MS plugin = 1.12.03 versions...

CVE-2022-47448 WordPress xili-tidy-tags Plugin <= 1.12.03 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in dev.Xiligroup.Com - MS plugin = 1.12.03 versions...

CVE-2022-47448

CVE-2022-47448 affects WordPress xili-tidy-tags plugin

PT-2023-15324 · Xiligroup · Dev.Xiligroup.Com - Ms Plugin

Name of the Vulnerable Software and Affected Versions: dev.Xiligroup.Com - MS plugin versions 1.12.03 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions ...

Ivanti Avalanche FileStoreConfig File Upload

Ivanti Avalanche prior to v6.4.0.186 permits MS-DOS style short names in the configuration path for the Central FileStore. Because of this, an administrator can change the default path to the web root of the applications, upload a JSP file, and achieve RCE as NT AUTHORITY\SYSTEM. Module Options m...

Ivanti Avalanche FileStoreConfig Shell Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ivanti Avalanche FileStoreConfig File Upload', 'Description' = %q Ivanti Avalanche prior to v6.4.0.186 permits MS-DOS style short names in the...

SUSE CVE-2023-32214

Protocol handlers ms-cxh and ms-cxh-full could have been leveraged to trigger a denial of service. Note: This attack only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox 113, Firefox ESR 102.11, and Thunderbird 102.11...

Office application installation when using a Citrix Workspace App version higher than 2107

When launching the first MS Office Pro Plus 2016 application in a session, a partial installation is ran...

SQL Injection

net.mingsoft, ms-mcms is vulnerable to SQL Injection. The vulnerability exists because the library does not properly validate the query strings in the basictitle parameter , allowing an attacker to inject and execute malicious SQL queries...

CVE-2023-0424

The MS-Reviews WordPress plugin through 1.5 does not sanitise and escape reviews, which could allow users any authenticated users, such as Subscribers to perform Stored Cross-Site Scripting attacks...