25 matches found
theftfuzzer
┌┬┐┬ ┬┌─┐┌─┐┌┬┐┌─┐┬ ┬┌─┐┌─┐┌─┐┬─┐ │ ├─┤├┤ ├┤ │ ├┤ │ │┌─┘┌─┘├┤ ├┬┘ ┴ ┴ ┴└─┘└ ┴ └ └─┘└─┘└─┘┴└─ 介绍： TheftFuzzer 是一款用于对跨域资源共享（CORS）实现进行常见错误配置模糊测试的工具。 用法： python theftfuzzer.py -d 'http://example.com/api/data' 帮助： python theftfuzzer.py -h $ python theftfuzzer.py -h usage: theftfuzzer.py -h -d DOMAIN -...
CVE-2026-106287
An information loss flaw was found in the CORS component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/513518289...
CVE-2026-106359
A confused deputy flaw was found in the DeviceBoundSessionCredentials component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/500532594...
CVE-2026-95362
A cross-site request forgery flaw was found in the DevTools component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/511791538...
CVE-2026-21784 HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
HCL IntelliOps Event Management IEM is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and resources susceptible to unauthorized external interaction and potential exploitation...
CVE-2026-21784 HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
HCL IntelliOps Event Management IEM is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and resources susceptible to unauthorized external interaction and potential exploitation...
CVE-2026-21784
HCL IntelliOps Event Management (IEM) ships with missing or insecure Cross-Origin Resource Sharing (CORS) headers, allowing unauthorized external origins to read application resources. CVSS 3.1 rates this MEDIUM (4.8), requiring high privileges and user interaction. No patch version, exploit, or ...
CVE-2026-21784: Exposure of Sensitive Information to an Unauthorized Actor
HCL IntelliOps Event Management IEM is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and resources susceptible to unauthorized external interaction and potential exploitation...
PT-2026-53794
Impact The previous BasicCookieStorage did not enforce RFC 6265 scoping rules around cookie domain, path, and Secure attribute. A client using a single storage instance to talk to multiple origins could have cookies leak across domains, or have Secure cookies sent over plain HTTP — the deprecatio...
NocoDB: Reflected Cross-Site Scripting via Password Reset Token
Summary The password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS HTML-entity-encodes a fixed set of characters but does not escape single quotes or backslashes, so a crafted token could break out of the JS string context and...
[SECURITY] [DLA 4215-1] ublock-origin security update
Debian LTS Advisory DLA-4215-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany June 12, 2025 https://wiki.debian.org/LTS Package : ublock-origin Version : 1.62.0+dfsg-0+deb11u1 CVE ID : CVE-2025-4215 Debian Bug : 1104635 A flaw was found in ublock-origin, a...
Fedora: Security Advisory (FEDORA-2024-69af78a508)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2024-57965
CVE-2024-57965 is a vulnerability in axios (before 1.7.8) where isURLSameOrigin.js does not use a URL object to determine origin and may perform an unwanted setAttribute('href', href). IBM security bulletins align this CVE with IBM Db2 Big SQL on Cloud Pak for Data and related products, noting an...
Ubuntu: Security Advisory (USN-7236-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2024-44212
A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Cookies belonging to one origin may be sent to another origin...
Debian: Security Advisory (DLA-558-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Mozilla: URL being dragged from cross-origin iframe into same tab triggers navigation
The Mozilla Foundation Security Advisory describes this flaw as: Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks...
CVE-2019-19741
Electronic Arts Origin 10.5.55.33574 is vulnerable to local privilege escalation due to arbitrary directory DACL manipulation, a different issue than CVE-2019-19247 and CVE-2019-19248. When Origin.exe connects to the named pipe OriginClientService, the privileged service verifies the client's...
Symantec Norton Password Manager CVE-2019-18381 Cross-Origin Security Bypass Vulnerability
Description Symantec Norton Password Manager is prone to a security bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks. Versions prior to Symantec Norton Password Manager...
