140 matches found
CVE-2018-12576
TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices allow clickjacking...
Security feature bypass
TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices allow clickjacking...
Brave Software: Local files reading using `link[rel="import"]`
Summary: HTML file could import another file using . Brave returns Access-Control-Allow-Origin: response header for local HTML files. That leads to local files reading. This vulnerability makes 369218 critical. Products affected: Brave: 0.23.19 V8: 6.7.288.46 rev:...
CVE-2018-10678: URL Redirection to Untrusted Site
MyBB 1.8.15, when accessed with Microsoft Edge, mishandles 'target="blank" rel="noopener"' in A elements, which makes it easier for remote attackers to conduct redirection attacks...
Solaris 10 (sparc) : 124301-16
Portal Server 7.1 Update 2 Solaris sparc: Maintenance Update Rel. Date this patch was last updated by Sun : Jan/31/11 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...
HackerOne: Reverse Tabnabbing Vulnerability in Outgoing Links
The external links in the reports are not properly handled, using the issue the links can access the openers and replace them with some other page. To Verify the issue, just go to any report which do have any external link and inspect the proceed button. Where the issue lies: rel="noreferrer"...
Infogram: Tabnabbing via window.opener
Hi Team, i would like to report tab nabbing issue on your domain. Details: When you open a link in a new tab target="blank" , the page that opens in a new tab can access the initial tab and change it's location using the window.opener property. PoC: 1.Navigate to...
Monero: TabNabbing issue (due to taget=_blank)
Hi team, i get to know in this particular url https://getmonero.org/get-started/what-is-monero/ and i found one 3rd party url. Issue lies Here : Here i can see you are using target=blank and no more rel tag. Here , target=blank means it will open in another new tab. but due to tabnabbing it can...
Instacart: Reverse Tab-nabbing at www.instacart.com/store/partner_recipe?recipe_url=
Summary Instacart at /store/partnerrecipe?recipeurl= endpoint is vulnerable to reverse tabnabbing, since the injected link use target="blank" , this means the page that opens in a new tab can access the initial tab and change its location using the window.opener property. example: Reproduction...
DEBIAN-CVE-2017-8393
The Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.28, is vulnerable to a global buffer over-read error because of an assumption made by code that runs for objcopy and strip, that SHTREL/SHRRELA sections are always named starting with a .rel/.rela prefix. This...
UBUNTU-CVE-2017-8393
The Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.28, is vulnerable to a global buffer over-read error because of an assumption made by code that runs for objcopy and strip, that SHTREL/SHRRELA sections are always named starting with a .rel/.rela prefix. This...
CVE-2017-8218
vsftpd on TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n has a backdoor admin account with the 1234 password, a backdoor guest account with the guest password, and a backdoor test account with the test password...
CVE-2017-8076: Inadequate Encryption Strength
On the TP-Link TL-SG108E 1.0, admin network communications are RC4 encoded, even though RC4 is deprecated. This affects the 1.1.2 Build 20141017 Rel.50749 firmware...
GitLab: Gitlab.com is vulnerable to reverse tabnabbing.
Dear GitLab bug bounty team, Summary --- Gitlab.com is vulnerable to reverse tabnabbing, since you use target="blank" on links in the Environments section. F166659 Why does this vulnerability exist? --- The following link is vulnerable to reverse tabnabbing, because it uses target="blank": This...
www2.lancom.de XSS vulnerability
Vulnerable URL: https://www.www2.lancom.de/docs/LCOS-Refmanual/9.10-Rel/EN/index.htmljavascript:alert/OPENBUGBOUNTY/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...
Coinbase: window.opener is leaking to external domains upon redirect on Safari
Although Coinbase cleared window.opener on external redirects, it was not effective on WebKit-based browsers Safari since Safari's cross-origin security prevents the modification of window.opener of a child window if it lies on a different origin, yet still allows the child window to access...
Instacart: Missing rel=noreferrer tag allows link in list to change url of currently open tab
Hi, When adding links to lists, there is no rel=noreferrer tag present, allowing a linked page to change the url of the currently open tab. This can open the doors for phishing attacks, as users trust the tab that contained instacart. As an example, see my list at https://inst.cr/t/1QmLPG. Clicki...
CVE-2016-5127
Use-after-free vulnerability in WebKit/Source/core/editing/VisibleUnits.cpp in Blink, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code involving an @import at-rule in a Cascadin...
CVE-2016-5127
Removed by vendor...
UBUNTU-CVE-2016-5127
Use-after-free vulnerability in WebKit/Source/core/editing/VisibleUnits.cpp in Blink, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code involving an @import at-rule in a Cascadin...