CVE-2022-44488

Adobe Experience Manager version 6.5.14 and earlier is affected by a URL Redirection to Untrusted Site 'Open Redirect' vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user...

CVE-2022-38662

In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites...

CVE-2022-38662

In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites...

HCL Digital Experience 输入验证错误漏洞

HCL Digital Experience is a suite of digital experience platforms, content delivery solutions from HCL India. HCL Digital Experience suffers from an input validation error vulnerability that stems from an attacker being able to construct URLs to redirect users to untrusted sites...

The World Cup: Prime Time for Sports Fans and Cybercriminals

From November 20 to December 18, fans from all over the world are tuned into the World Cup tournament in Qatar. While this is a major event for sports fans, it’s also prime time for bad actors. Large sporting events lead to increased levels of activity across sports and gambling sites, along with...

CVE-2022-38662 HCL Digital Experience is susceptible to open redirects

In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites...

CVE-2022-38662 HCL Digital Experience is susceptible to open redirects

In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites...

PT-2022-24512 · Hcl · Hcl Digital Experience

Name of the Vulnerable Software and Affected Versions: HCL Digital Experience affected versions not specified Description: The issue allows URLs to be constructed in a way that redirects users to untrusted sites. Recommendations: At the moment, there is no information about a newer version that...

Cross-site Scripting (XSS)

nuxt is vulnerable to cross-site scriptingXSS attacks. A malicious user is able to pass a specifically crafted URL with no protocol or search parameters through the getPayloadURL function and execute harmful JavaScript on the target system. The vulnerability currently exists only on prerendered...

curl: Incorrect handling of control code characters in cookies

A vulnerability found in curl. This security flaw happens when curl is used to retrieve and parse cookies from an HTTPS server, where it accepts cookies using control codes byte values below 32, and also when cookies that contain such control codes are later sent back to an HTTPS server, possibly...

CryWiper Data Wiper Targeting Russian Sites

Kaspersky is reporting on a data wiper masquerading as ransomware that is targeting local Russian government networks. The Trojan corrupts any data thats not vital for the functioning of the operating system. It doesnt affect files with extensions .exe, .dll, .lnk, .sys or .msi, and ignores sever...

SHIRASAGI 输入验证错误漏洞

SHIRASAGI is a content management system CMS for the Japanese Shirasagi project. A security vulnerability exists in SHIRASAGI v1.14.4 to v1.15.0, which can be exploited by attackers to redirect users to arbitrary websites and conduct phishing attacks...

The vulnerability of Websoft HCM’s automation software for HR processes lies in the redirection of URLs to unreliable websites, allowing attackers to redirect users to arbitrary URL addresses.

The vulnerability of Websoft HCM’s automation software for HR processes involves the redirection of URLs to an unreliable website. Exploiting this vulnerability allows a malicious actor to remotely redirect users to any given URL address...

GHSA-VVXF-R4VM-2VM6 Reflected XSS in querystring parameters

An attacker could inject a XSS payload in a Silverstripe CMS response by carefully crafting a return URL on a /dev/build or /Security/login request. To exploit this vulnerability, an attacker would need to convince a user to follow a link with a malicious payload. This will only affect projects...

Reflected XSS in querystring parameters

An attacker could inject a XSS payload in a Silverstripe CMS response by carefully crafting a return URL on a /dev/build or /Security/login request. To exploit this vulnerability, an attacker would need to convince a user to follow a link with a malicious payload. This will only affect projects...

CVE-2022-37332

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A specially-crafted PDF document can trigger the reuse of previously freed memory via misusing media player API, which can lead to arbitrary code execution. An attacker needs to...

USN-5730-1 webkit2gtk vulnerabilities

Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and...

webkitgtk: Use-after-free leading to arbitrary code execution

A use-after-free vulnerability was found in WebKitGTK. The flaw occurs when processing maliciously crafted HTML content in WebKit. This flaw allows a remote attacker to trick the victim into visiting a specially crafted website, triggering memory corruption and executing arbitrary code on the...

PT-2022-23931 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit Software's PDF Reader version 12.0.1.12430 Description: A use-after-free issue exists in the JavaScript engine, allowing arbitrary code execution through the misuse of the media player API. This can be triggered by opening a...

Safe Browsing now on Opera for Android

Security Safe Browsing now on Opera for Android Share November 11th, 2022 Hi Android users! We’re happy to share that Opera for Android 72 now features Safe Browsing to keep you even safer when browsing or shopping online on your Android device. Safe Browsing protects your online experience by...