Mozilla: Leaking browser history with CSS variables

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Firefox behaving slightly differently for already known resources when loading CSS resources involving CSS variables. This flaw could probe the browser history...

Mozilla: Leaking browser history with CSS variables

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Firefox behaving slightly differently for already known resources when loading CSS resources involving CSS variables. This flaw could probe the browser history...

Mozilla: Leaking browser history with CSS variables

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Firefox behaving slightly differently for already known resources when loading CSS resources involving CSS variables. This flaw could probe the browser history...

Mozilla Firefox ESR < 91.9

The version of Firefox ESR installed on the remote Windows host is prior to 91.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-17 advisory. - Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safet...

Mozilla Firefox 信息泄露漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from an information disclosure vulnerability that stems from the browser behaving differently when loading CSS variables from known resources, which can be exploited by an...

PT-2022-3139 · Microsoft · Windows Hyper-V +1

Name of the Vulnerable Software and Affected Versions: Microsoft Windows Hyper-V affected versions not specified Description: The issue is related to synchronization errors when using a shared resource in the Hyper-V hardware virtualization system of Microsoft Windows operating systems. It allows...

Security Vulnerabilities fixed in Firefox ESR 91.9 — Mozilla

When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existin...

Which Hole to Plug First? Solving Chronic Vulnerability Patching Overload

According to folklore, witches were able to sail in a sieve, a strainer with holes in the bottom. Unfortunately, witches don't work in cybersecurity – where networks generally have so many vulnerabilities that they resemble sieves. For most of us, keeping the sieve of our networks afloat requires...

CVE-2022-1195

A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilege to cause a denial of service DOS when the mkiss or sixpack device is detached and reclaim resources early...

Design/Logic Flaw

A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilege to cause a denial of service DOS when the mkiss or sixpack device is detached and reclaim resources early...

[SECURITY] Fedora 35 Update: golang-k8s-sample-controller-1.22.0-3.fc35

This package implements a simple controller for watching Foo resources as defined with a CustomResourceDefinition CRD...

Monstaftp server-side request forgery vulnerability

Monstaftp is a modern Web interface for FTP. version v2.10.3 of Monstaftp is vulnerable to server-side request forgery, which stems from the product's failure to properly validate user input and can be exploited by attackers to probe server intranet resources...

The vulnerability of the Advanced Local Procedure Call (ALPC) handler in the Windows operating system allows attackers to escalate their privileges.

The vulnerability of the Advanced Local Procedure Call ALPC in the Windows operating system arises due to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to increase their privileges...

Firms Push for CVE-Like Cloud Bug System

Big gaps exist in the 22-year-old Common Vulnerability and Exposures CVE system that do not address dangerous flaws in cloud services that drive millions of apps and backend services. Too often, cloud providers needlessly expose customers to risk by not sharing the details of bugs discovered on...

Monstaftp 代码问题漏洞

Monstaftp is a modern Web interface for FTP. version v2.10.3 of Monstaftp is vulnerable to server-side request forgery, which stems from the product's failure to properly validate user input and can be exploited by attackers to probe server intranet resources...

USN-5387-1 barbican vulnerabilities

Douglas Mendizábal discovered that Barbican incorrectly handled access restrictions. An authenticated attacker could possibly use this issue to consume protected resources and possibly cause a denial of service. CVE-2022-23451, CVE-2022-23452...

Cross-Site Request Forgery (CSRF)

MCMS is vulnerable to cross site request forgery. The vulnerability exists due to lack of handling of parameters, allowing an attacker to bypass authentication and submit request on the behalf of the server and gain access to internal resources via the file or endpoint /role/saveOrUpdateRole.do...

EulerOS 2.0 SP5 : xerces-j2 (EulerOS-SA-2022-1555)

According to the versions of the xerces-j2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - There's a vulnerability within the Apache Xerces Java XercesJ XML parser when handling specially crafted XML document payloads. This causes, t...

Ubuntu 18.04 LTS / 20.04 LTS : Barbican vulnerabilities (USN-5387-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5387-1 advisory. Douglas Mendizbal discovered that Barbican incorrectly handled access restrictions. An authenticated attacker could possibly use this issue t...

Unified Cybersecurity Platform: Why CISOs are Shifting

Our global study polled more than 2,300 IT security decision makers to discover how to best assist and support SecOps teams with a unified cybersecurity platform so you can be more resilient with less resources...