622 matches found
CVE-2022-33720
Improper authentication vulnerability in AppLock prior to SMR Aug-2022 Release 1 allows physical attacker to access Chrome locked by AppLock via new tap shortcut...
PT-2022-21837 · Google · Google Chrome
Name of the Vulnerable Software and Affected Versions: AppLock versions prior to SMR Aug-2022 Release 1 Description: The issue is related to improper authentication, allowing a physical attacker to bypass the lock and access Chrome when it is locked by AppLock. This can be achieved via a new tap...
Evilnum strikes commodities and cryptocurrency Forum
Threat Level Actor Report For a detailed advisory, download the pdf file here Summary In recent campaigns, the Evilnum actor group has targeted the Decentralized Finance DeFi sector using Evilnum Malware. The latest iteration of Evilnum backdoor employs a diverse set of ISO, Microsoft Word, and...
CVE-2022-36314
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that leads to unexpected network requests from the operating system...
Security Vulnerabilities fixed in Thunderbird 102.1 — Mozilla
When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed. When visiting directory listings for chrome:// URLs as source text, some parameters were reflected. When opening a Windows shortcut from the local filesystem, an...
Mozilla Firefox < 103.0
The version of Firefox installed on the remote Windows host is prior to 103.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-28 advisory. - Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs...
Security Vulnerabilities fixed in Firefox 103 — Mozilla
When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed. When visiting a website with an overly long URL, the user interface would start to hang. Due to session restore, this could lead to a permanent Denial of Service.Th...
Mozilla Firefox 代码问题漏洞
Mozilla Firefox is an open source web browser from the Mozilla Foundation. A security vulnerability exists in Mozilla Firefox versions 100.0 through 102.0.1 and Mozilla ESR versions 102.0 through 102.0.1, which originates from an error when opening a .lnk shortcut on a system, which could allow t...
CVE-2022-1956
The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which could allow any authenticated users, such as subscriber, to update them...
CVE-2022-1956
The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which could allow any authenticated users, such as subscriber, to update them...
Cross site request forgery (csrf)
The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which could allow any authenticated users, such as subscriber, to update them...
CVE-2022-1956
CVE-2022-1956 affects the Shortcut Macros WordPress plugin (versions up to 1.3). The root cause is missing authorization and CSRF checks when updating plugin settings, enabling any authenticated user (e.g., a subscriber) to update settings. The public documents describe a CSRF attack workflow and...
WordPress pluginShortcut Macros 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Shortcut Macros plugin 1.3 and earlier versions are vulnerable to cross-site request forgery, which...
PT-2022-14216 · WordPress · Shortcut Macros
Name of the Vulnerable Software and Affected Versions: The Shortcut Macros WordPress plugin versions 1.3 and earlier Description: The issue is related to the lack of authorization and CSRF checks when updating settings in the plugin. This could allow any authenticated users, such as subscribers, ...
New 'Quantum' Builder Lets Attackers Easily Create Malicious Windows Shortcuts
A new malware tool that enables cybercriminal actors to build malicious Windows shortcut .LNK files has been spotted for sale on cybercrime forums. Dubbed Quantum Lnk Builder, the software makes it possible to spoof any extension and choose from over 300 icons, not to mention support UAC and...
Alt + PrtSc shortcut not working when using KeyboardEventMode = Unicode with a Japanese keyboard
In Citrix Workspace App for Linux, when using Unicode keyboard event mode with a Japanese keyboard, the Alt + PrtSc combination/shortcut does not work...
Shortcut Macros <= 1.3 - Subscriber+ Arbitrary Settings Update
The plugin does not have authorisation and CSRF checks in place when updating its settings, which could allow any authenticated users, such as subscriber, to update them. Open the following HTML code while being logged in as a subscriber, or make any logged in user open it via a CSRF attack...
Shortcut Macros <= 1.3 - Subscriber+ Arbitrary Settings Update
The plugin does not have authorisation and CSRF checks in place when updating its settings, which could allow any authenticated users, such as subscriber, to update them. PoC Open the following HTML code while being logged in as a subscriber, or make any logged in user open it via a CSRF attack...
PersistBOF - Tool To Help Automate Common Persistence Mechanisms
A tool to help automate common persistence mechanisms. Currently supports Print Monitor SYSTEM, Time Provider Network Service, Start folder shortcut hijacking User, and Junction Folder User Usage Clone, run make, add .cna to Cobalt Strike client. run: help persist-ice in CS console Syntax:...
