PT-2022-14539 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to improper input validation in KeyChain, allowing a possible spoof keychain chooser activity request. This could lead to local escalation of privilege with System execution...

ZEIT Next.js和NextAuth.js 输入验证错误漏洞

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack and Babel.js.NextAuth.js is the authentication for Next.js. An input validation error vulnerability exists in the NextAuth.js component of Next.js, which stems from the fact that an attacker can...

Samba 权限许可和访问控制问题漏洞

Samba is the standard Windows interoperability program suite for Linux and Unix. Samba 4.3 and prior versions are vulnerable to a privilege-granting and access-control issue that stems from the KDC accepting kpasswd requests encrypted with any key known to it. By encrypting a spoofed kpasswd...

WordPress plugin Sygnoos Popup Builder 跨站请求伪造漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in WordPress Sygnoos Popup Builder 4.1.11 and prior versions, which arises from a web applicatio...

Hackers can spoof commit metadata to create false GitHub repositories

By Deeba Ahmed Checkmarx security researchers have warned about an emerging new supply chain attack tactic involving spoofed metadata commits to present malicious… This is a post from HackRead.com Read the original post: Hackers can spoof commit metadata to create false GitHub repositories...

CVE-2022-32308

Cross Site Scripting XSS vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofed 'MessageSender.url' to the browser renderer process...

CVE-2022-32308

Cross Site Scripting XSS vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofed 'MessageSender.url' to the browser renderer process...

DEBIAN-CVE-2022-32308

Cross Site Scripting XSS vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofed 'MessageSender.url' to the browser renderer process...

Cross site scripting

Cross Site Scripting XSS vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofed 'MessageSender.url' to the browser renderer process...

UBUNTU-CVE-2022-32308

Cross Site Scripting XSS vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofed 'MessageSender.url' to the browser renderer process...

CVE-2022-32308

Cross Site Scripting XSS vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofed 'MessageSender.url' to the browser renderer process...

UBUNTU-CVE-2015-5236

It was discovered that the IcedTea-Web used codebase attribute of the tag on the HTML page that hosts Java applet in the Same Origin Policy SOP checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value...

CVE-2015-5236

It was discovered that the IcedTea-Web used codebase attribute of the tag on the HTML page that hosts Java applet in the Same Origin Policy SOP checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value...

lxml 和 libxml2 代码问题漏洞

lxml is lxml personal developer can interact with Python for locating elements in Html software . libxml2 is an open source library for parsing XML documents . It is written in C, and can be called for a variety of languages, such as C, C++, XSH. A code issue vulnerability exists in lxml and...

Jorani 跨站请求伪造漏洞

Jorani is a leave management system. Designed to provide small organizations with a simple workflow for leave and overtime requests. A cross-site request forgery vulnerability exists in Jorani version 1.0, which stems from the /application/controllers/Users.php page not adequately verifying that ...

Watch out for the email that says “You have a new voicemail!”

A phishing campaign is using voicemail notification messages to go after victims Office 365 credentials. According to researchers at ZScaler, the campaign uses spoofed emails with an HTML attachment that contains encoded javascript. The email claims that you have a new voicemail and that you can...

Information Disclosure

kernel is vulnerable to information disclosure. The vulnerability exists due to a flaw was found in the Linux SCTP stack allowing an attacker to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send...

WordPress plugin Copify cross-site request forgery vulnerability

WordPress is a set of blogging platform developed using the PHP language. A cross-site request forgery vulnerability exists in the WordPress plugin Copify 1.3.0 and prior versions, which stems from a lack of random number validation on the CopifySettings page. An attacker could exploit this...

WordPress plugin Copify 跨站请求伪造漏洞

WordPress is a set of blogging platform developed using the PHP language. A cross-site request forgery vulnerability exists in the WordPress plugin Copify 1.3.0 and prior versions, which stems from a lack of random number validation on the CopifySettings page. An attacker could exploit this...

Researchers Detail How Cyber Criminals Targeting Cryptocurrency Users

Cybercriminals are impersonating popular crypto platforms such as Binance, Celo, and Trust Wallet with spoofed emails and fake login pages in an attempt to steal login details and deceptively transfer virtual funds. "As cryptocurrency and non-fungible tokens NFTs become more mainstream, and captu...