UBUNTU-CVE-2022-32308

Cross Site Scripting XSS vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofed 'MessageSender.url' to the browser renderer process...

CVE-2022-32308

Cross Site Scripting XSS vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofed 'MessageSender.url' to the browser renderer process...

UBUNTU-CVE-2015-5236

It was discovered that the IcedTea-Web used codebase attribute of the tag on the HTML page that hosts Java applet in the Same Origin Policy SOP checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value...

CVE-2015-5236

It was discovered that the IcedTea-Web used codebase attribute of the tag on the HTML page that hosts Java applet in the Same Origin Policy SOP checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value...

lxml 和 libxml2 代码问题漏洞

lxml is lxml personal developer can interact with Python for locating elements in Html software . libxml2 is an open source library for parsing XML documents . It is written in C, and can be called for a variety of languages, such as C, C++, XSH. A code issue vulnerability exists in lxml and...

Jorani 跨站请求伪造漏洞

Jorani is a leave management system. Designed to provide small organizations with a simple workflow for leave and overtime requests. A cross-site request forgery vulnerability exists in Jorani version 1.0, which stems from the /application/controllers/Users.php page not adequately verifying that ...

Watch out for the email that says “You have a new voicemail!”

A phishing campaign is using voicemail notification messages to go after victims Office 365 credentials. According to researchers at ZScaler, the campaign uses spoofed emails with an HTML attachment that contains encoded javascript. The email claims that you have a new voicemail and that you can...

Information Disclosure

kernel is vulnerable to information disclosure. The vulnerability exists due to a flaw was found in the Linux SCTP stack allowing an attacker to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send...

WordPress plugin Copify cross-site request forgery vulnerability

WordPress is a set of blogging platform developed using the PHP language. A cross-site request forgery vulnerability exists in the WordPress plugin Copify 1.3.0 and prior versions, which stems from a lack of random number validation on the CopifySettings page. An attacker could exploit this...

WordPress plugin Copify 跨站请求伪造漏洞

WordPress is a set of blogging platform developed using the PHP language. A cross-site request forgery vulnerability exists in the WordPress plugin Copify 1.3.0 and prior versions, which stems from a lack of random number validation on the CopifySettings page. An attacker could exploit this...

Researchers Detail How Cyber Criminals Targeting Cryptocurrency Users

Cybercriminals are impersonating popular crypto platforms such as Binance, Celo, and Trust Wallet with spoofed emails and fake login pages in an attempt to steal login details and deceptively transfer virtual funds. "As cryptocurrency and non-fungible tokens NFTs become more mainstream, and captu...

Design/Logic Flaw

An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The client will perform TLS certificate verification of the malicious domain name instead of the original XMPP service domain, allowing the attack...

CVE-2018-18541

In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response involved in the connection build up. A remote attacker could send connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download...

Lenovo Personal Cloud Storage命令注入漏洞

Lenovo Personal Cloud Storage is a cloud storage platform from Lenovo China.Lenovo Personal Cloud Storage is vulnerable to command injection. An attacker could use the vulnerability to execute operating system commands by sending spoofed packets to the device...

PT-2022-16974 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.3.4 Argo CD versions prior to 2.2.9 Argo CD versions prior to 2.1.15 Description: A vulnerability was found in Argo CD that allows an attacker to spoof error messages on the login screen when single sign on SSO is...

Lenovo Personal Cloud Storage 操作系统命令注入漏洞

Lenovo Personal Cloud Storage is a cloud storage platform from Lenovo China.Lenovo Personal Cloud Storage is vulnerable to command injection. An attacker could use the vulnerability to execute operating system commands by sending spoofed packets to the device...

GHSA-C82R-QG3W-Q5MV Apache Solr insecure inter-node communication

Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node. This can trick the nodes in cluster to believe that the malicious...

Stormshield Network Security 代码问题漏洞

Stormshield Network Security is a next-generation UTM Unified Threat Management firewall from Stormshield France. A security vulnerability exists in Stormshield Network Security SNS version 4.3.x up to and including 4.3.8, which stems from an event log entry in the ASQ sofbus lacbus plugin that...

kernel: sctp: Invalid chunks may be used to remotely remove existing associations

A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses...

kernel: sctp: Invalid chunks may be used to remotely remove existing associations

A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses...