3700 matches found
PT-2024-14923 · WordPress · Woostify Sites Library
Name of the Vulnerable Software and Affected Versions: Woostify Sites Library WordPress plugin versions prior to 1.4.8 Description: The issue concerns a lack of authorization in an AJAX action, allowing any authenticated users to update arbitrary blog options and set them to 'activated'. This cou...
CVE-2024-23388
Improper authorization in handler for custom URL scheme issue in "Mercari" App for Android prior to version 5.78.0 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack...
curl: Incorrect handling of control code characters in cookies
A vulnerability found in curl. This security flaw happens when curl is used to retrieve and parse cookies from an HTTPS server, where it accepts cookies using control codes byte values below 32, and also when cookies that contain such control codes are later sent back to an HTTPS server, possibly...
Publitas: CORS Misconfiguration on █████
A cross-origin resource sharing misconfiguration was found that could allow an attacker to steal sensitive user information or force unwanted actions. The misconfiguration allowed credentials and enabled CORS for external domains. A proof of concept was shown that could exploit this to exfiltrate...
"Mercari" App for Android fails to restrict custom URL schemes properly
Overview "Mercari" App for Android by Mercari, Inc. provides the function to access a requested URL using Custom URL Scheme. The App does not restrict access to the function properly CWE-939 which may be exploited to direct the App to access any sites. Shiga Takuma of BroadBand Security Inc...
Simple Membership < 4.4.2 - Open Redirect
Description The plugin is vulnerable to Open Redirect. This is due to insufficient validation on the redirect url supplied via the swpmpageurl parameter, making it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into...
CVE-2024-0605
The CVE-2024-0605 issue affects Mozilla Focus for iOS prior to version 122. A race condition arises when using a javascript: URI with setTimeout, enabling an attacker to run unauthorized scripts on top-origin sites via the URL bar, potentially leading to arbitrary code execution or unauthorized a...
Security Vulnerabilities fixed in Focus for iOS 122 — Mozilla
Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security measures, potentially leading to arbitrary code execution or unauthorized actions within the user's loaded webpage. An attacker could execut...
PT-2024-15683 · Facebook · Focus
Name of the Vulnerable Software and Affected Versions: Focus for iOS versions prior to 122 Description: The issue allows an attacker to execute unauthorized scripts on top origin sites in the urlbar by using a javascript: URI with a setTimeout race condition. This bypasses security measures,...
The vulnerability of the Advanced UI component of the Oracle WebCenter Sites application allows a malicious actor to gain access to read, modify, or delete data.
The vulnerability of the Advanced UI component in Oracle WebCenter Sites applications relates to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to gain access to read, modify, or delete data...
Oracle WebCenter Sites (January 2024 CPU)
The 12.2.1.4.0 version of WebCenter Sites installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2024 CPU advisory. - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: Advanced UI. The supported version that is...
Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect
Description The plugin is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callback.php file. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. PoC...
CVE-2024-20908
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: Advanced UI. The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites...
CVE-2024-20908
Oracle WebCenter Sites (12.2.1.4.0) is affected by a vulnerability in the Advanced UI that allows an unauthenticated attacker with network access over HTTP to potentially modify or read data. The issue requires user interaction and may impact other Oracle Fusion Middleware products (scope change)...
CVE-2023-3771
The T1 WordPress theme through 19.0 is vulnerable to unauthenticated open redirect with which any attacker and redirect users to arbitrary websites...
“I’ll miss him so much” Facebook scam uses BBC branding to lure victims
Facebook scams are a constant nuisance and vary from like-farming to scams that can cost you some serious money. The latest one we found is a bit morbid. Recently, I’ve seen quite a few posts on my timeline that looked like this: Without going into details the post says: “I can’t believe he’s gon...
PT-2024-1163 · Oracle · Oracle Webcenter Sites
Name of the Vulnerable Software and Affected Versions: Oracle WebCenter Sites version 12.2.1.4.0 Description: The issue is related to insufficient input validation in the Advanced UI component of Oracle WebCenter Sites, allowing an unauthenticated attacker with network access via HTTP to compromi...
Oracle Fusion Middleware Security Vulnerability
Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle USA. The platform provides middleware, software collections, and other capabilities. A security vulnerability exists in Oracle WebCenter Sites version...
Fedora 39 : python-flask-security-too (2024-f34963bef8)
The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-f34963bef8 advisory. Backport fix for CVE-2023-49438. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...
Atomic Stealer Gets an Upgrade - Targeting Mac Users with Encrypted Payload
Cybersecurity researchers have identified an updated version of a macOS information stealer called Atomic or AMOS, indicating that the threat actors behind the malware are actively enhancing its capabilities. "It looks like Atomic Stealer was updated around mid to late December 2023, where its...