3589 matches found
Authorization
Improper authorization in handler for custom URL scheme vulnerability in ????????? asken diet for Android versions from v.3.0.0 to v.4.2.x allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App...
CVE-2021-20733
CVE-2021-20733 concerns Asken Diet (Android) where improper authorization in the handler for a custom URL scheme allows a remote attacker to steer a user to an arbitrary website via the vulnerable app. Affected versions are v3.0.0 through v4.2.x. The root cause is insufficient access control arou...
CVE-2021-20733
Improper authorization in handler for custom URL scheme vulnerability in あすけんダイエット asken diet for Android versions from v.3.0.0 to v.4.2.x allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App...
CVE-2021-20733: Missing Authorization
Improper authorization in handler for custom URL scheme vulnerability in あすけんダイエット asken diet for Android versions from v.3.0.0 to v.4.2.x allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App...
PT-2021-14189 · あすけんダイエット · あすけんダイエット
Name of the Vulnerable Software and Affected Versions: あすけんダイエット asken diet versions 3.0.0 through 4.2.x Description: The issue is related to improper authorization in the handler for a custom URL scheme, allowing a remote attacker to lead a user to access an arbitrary website via the vulnerable...
Cross-site Scripting (XSS) - Stored in thoughtbot/administrate
💥 BUG Stored xss using unsanitize url 💥 IMPACT There is no url scheme sanitization, allow to provide javascript protocol in url which cause xss 💥 PAYLOAD javascript:alertdocument.domain 💥 STEP TO REPRODUCE tested in demo version https://administrate-demo.herokuapp.com/admin.\ 1. Plz check this 1...
Andariel evolves to target South Korea with ransomware
Executive summary In April 2021, we observed a suspicious Word document with a Korean file name and decoy. It revealed a novel infection scheme and an unfamiliar payload. While we were doing our research into these findings, Malwarebytes published a nice report with technical details about the sa...
JVN#38034268: あすけん App for Android fails to restrict custom URL schemes properly
あすけん App for Android by asken Inc. provides the function to access a requested URL using Custom URL Scheme. The App does not restrict access to the function properly CWE-939 which may be exploited to direct the App to access any sites. Impact A remote attacker may lead a user to access an arbitra...
CVE-2021-33359
A vulnerability exists in gowitness 2.3.6 that allows an unauthenticated attacker to perform an arbitrary file read using the file:// scheme in the url parameter to get an image of any file...
CVE-2021-33359
A vulnerability exists in gowitness 2.3.6 that allows an unauthenticated attacker to perform an arbitrary file read using the file:// scheme in the url parameter to get an image of any file...
CVE-2021-33359
A vulnerability exists in gowitness 2.3.6 that allows an unauthenticated attacker to perform an arbitrary file read using the file:// scheme in the url parameter to get an image of any file...
PT-2021-20127
Name of the Vulnerable Software and Affected Versions gowitness versions prior to 2.3.6 Description A vulnerability exists that allows an unauthenticated attacker to perform an arbitrary file read using the file:// scheme in the url parameter to get an image of any file. Recommendations For...
sensepost gowitness 授权问题漏洞
gowitness is a website screenshot utility program written in Golang. An authorization issue vulnerability exists in sensepost gowitness that stems from a lack of authentication measures in gowitness. Exploitation of this vulnerability allows an unauthenticated attacker to perform arbitrary file...
CVE-2021-33359: Files or Directories Accessible to External Parties
A vulnerability exists in gowitness 2.3.6 that allows an unauthenticated attacker to perform an arbitrary file read using the file:// scheme in the url parameter to get an image of any file...
Jira Server and Jira Data Center 跨站脚本漏洞
Atlassian JIRA Server and Jira Server & Data Center are both products of Atlassian Australia.Atlassian JIRA Server is the server version of a defect tracking management system. The system is mainly used for tracking and managing all kinds of problems and defects in the workplace.Jira Server & Dat...
USN-4981-1 squid, squid3 vulnerabilities
Joshua Rogers discovered that Squid incorrectly handled requests with the urn: scheme. A remote attacker could possibly use this issue to cause Squid to consume resources, leading to a denial of service. CVE-2021-28651 Joshua Rogers discovered that Squid incorrectly handled requests to the Cache...
DoJ Charges Rhode Island Woman in Phishing Scheme Against Politicians
The Department of Justice DoJ has charged a woman in Rhode Island in a phishing campaign against candidates for political office and related associates that impersonated various individuals–including campaign workers and the Microsoft security team—in an attempt to trick victims into providing...
JVN#91691168: goo blog App fails to restrict custom URL schemes properly
goo blog App by NTT Resonant Incorporated provides the function to access a requested URL using Custom URL Scheme. The App does not restrict access to the function properly CWE-284 which may be exploited to direct the App to access any sites. Impact A remote attacker may lead a user to access an...
StaticFile.fromUrl can leak presence of a directory
Impact StaticFile.fromUrl can leak the presence of a directory on a server when the URL scheme is not file://, and the URL points to a fetchable resource under its scheme and authority. The function returns FNone, indicating no resource, if url.getFile is a directory, without first checking the...
CVE-2021-32643
Http4s is a Scala interface for HTTP services. StaticFile.fromUrl can leak the presence of a directory on a server when the URL scheme is not file://, and the URL points to a fetchable resource under its scheme and authority. The function returns FNone, indicating no resource, if url.getFile is a...