37 matches found
Dependency-Track 安全漏洞
Dependency-Track is an intelligent supply chain component analysis platform for identifying third-party component risks. A security vulnerability exists in versions of Dependency-Track prior to 4.6.1 that stems from not coding or cleaning up the output of Showdown, which allows arbitrary JavaScri...
CVE-2022-39350 @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details
@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Due to the common practice of providing vulnerability details in markdown format, the...
CVE-2022-39350 @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details
@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Due to the common practice of providing vulnerability details in markdown format, the...
CVE-2022-39350
CVE-2022-39350 affects @dependencytrack/frontend (Dependency-Track frontend). The issue arises because vulnerability details rendered with Showdown were not encoded/sanitized before version 4.6.1, allowing arbitrary JavaScript in vulnerability fields (Description, Details, Recommendation, Referen...
PT-2022-24919 · Unknown +1 · @Dependencytrack/Frontend +1
Name of the Vulnerable Software and Affected Versions: @dependencytrack/frontend versions prior to 4.6.1 Description: The Dependency-Track frontend is a Single Page Application SPA that renders vulnerability details using the JavaScript library Showdown. Since Showdown does not have any XSS...
Groove Calls for Cyberattacks on US as REvil Payback
UPDATE: Subsequent reporting and disclosures show “Groove” was a hoax intended to lure media outlets into reporting on fake potential threats against U.S. government interests. Threatpost regrets falling for a troll. Lesson learned and apologies to our readers. Following the recent international...
Reverse Tabnabbing in showdown
Versions of showdown prior to 1.9.1 are vulnerable to Reverse Tabnabbing. The package uses target='blank' in anchor tags, allowing attackers to access window.opener for the original page when opening links. This is commonly used for phishing attacks. Recommendation Upgrade to version 1.9.1 or lat...
Trump's Ukraine Delusion, Tesla's Ford Showdown, and More News
Catch up on the most important news from today in two minutes or less...
Reverse Tabnabbing
showdown is vulnerable to reverse tabnabbing. The vulnerability exists due to a misconfiguration whereby the setting of rel="noopener noreferrer" is not set when openLinksInNewWindow is on...
Reverse Tabnabbing
Overview Versions of showdown prior to 1.9.1 are vulnerable to Reverse Tabnabbing. The package uses target='blank' in anchor tags, allowing attackers to access window.opener for the original page when opening links. This is commonly used for phishing attacks. Recommendation Upgrade to version 1.9...
The Showdown: Hackers vs. Accountants
By Waqas A showdown between hackers and accountants is unlikely to have This is a post from HackRead.com Read the original post: The Showdown: Hackers vs. Accountants...
Basketball Showdown - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities
HackApp vulnerability scanner discovered that application Basketball Showdown published at the 'play' market has multiple vulnerabilities...
Hockey Showdown - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities
HackApp vulnerability scanner discovered that application Hockey Showdown published at the 'play' market has multiple vulnerabilities...
Basketball Showdown 2015 - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities
HackApp vulnerability scanner discovered that application Basketball Showdown 2015 published at the 'play' market has multiple vulnerabilities...
Bingo Showdown - Customized SSL, Dangerous filesystem permissions, Insecure KeyStore vulnerabilities
HackApp vulnerability scanner discovered that application Bingo Showdown published at the 'play' market has multiple vulnerabilities...
Pirates! Showdown Full Free - Dynamic Code Loading, External URLs, Native code usage vulnerabilities
HackApp vulnerability scanner discovered that application Pirates! Showdown Full Free published at the 'play' market has multiple vulnerabilities...
Yahoo! Announces Hack U™ Spring 2011 Series !
Yahoo! is proud to announce the Hack U™ Spring 2011 calendar of events. Join Yahoo! web experts for a week of learning, hacking and fun! You'll hear interesting tech talks, hacking tips and lessons, and get hands-on coding workshops where you'll work with cutting-edge technology. The week's event...