3514 matches found
Microcin is here
In February 2020, we observed a Trojan injected into the system process memory on a particular host. The target turned out to be a diplomatic entity. What initially attracted our attention was the enterprise-grade API-like application programming interface programming style. Such an approach is n...
Google Chrome CSS Code Issue Vulnerability
Google Chrome is a web browser from Google, an American company. A security vulnerability exists in CSS in Google Chrome versions prior to 11.0.0.0. A remote attacker can exploit this vulnerability to cause heap corruption with the help of specially crafted HTML pages...
UBUNTU-CVE-2018-18624
Grafana 5.3.1 has XSS via a column style on the "Dashboard Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099...
style-picks.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1177043 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
style-it.jp Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1172204 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
British Airline EasyJet Suffers Data Breach Exposing 9 Million Customers' Data
British low-cost airline EasyJet today admitted that the company has fallen victim to a cyber-attack, which it labeled "highly sophisticated," exposing email addresses and travel details of around 9 million of its customers. In an official statement released today, EasyJet confirmed that of the 9...
Heybbs has a universal password login vulnerability
HEYBBS is a front-end based on bootstrap+jq+css,back-end php+mysql development of micro-community programs. Heybbs has a universal password login vulnerability that can be exploited by attackers to obtain sensitive database information...
The vulnerability of the WordPress website content management system, related to the lack of measures taken to protect the structure of web pages, allows attackers to compromise the integrity of data.
The vulnerability of the WordPress website content management system is related to an XSS attack that allows JavaScript to be injected into the STYLE code. Exploiting this vulnerability could enable a malicious actor to compromise the integrity of the data...
Updated mediawiki packages fix security vulnerability
Updated mediawiki packages fix security vulnerability: In MediaWiki before 1.31.7, users can add various Cascading Style Sheets CSS classes which can affect what content is shown or hidden in the user interface to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because...
Unkillable xHelper and a Trojan matryoshka
It was the middle of last year that we detected the start of mass attacks by the xHelper Trojan on Android smartphones, but even now the malware remains as active as ever. The main feature of xHelper is entrenchment — once it gets into the phone, it somehow remains there even after the user delet...
CVE-2020-10960
In MediaWiki before 1.34.1, users can add various Cascading Style Sheets CSS classes which can affect what content is shown or hidden in the user interface to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler ...
Regular Expression Denial-of-Service (ReDoS)
bleach is vulnerable to regular expression denial of service ReDoS. The vulnerability exists when parsing style attributes through sanitizecss...
GHSA-VQHP-CXGC-6WMM regular expression denial-of-service (ReDoS) in Bleach
Impact bleach.clean behavior parsing style attributes could result in a regular expression denial of service ReDoS. Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean..., attributes='a': 'style'. Patches 3.1.4 Workarounds d...
PYSEC-2020-340
In Mozilla Bleach before 3.1.4, bleach.clean behavior parsing style attributes could result in a regular expression denial of service ReDoS...
PYSEC-2020-340
In Mozilla Bleach before 3.1.4, bleach.clean behavior parsing style attributes could result in a regular expression denial of service ReDoS...
PT-2020-2139 · Mediawiki +1 · Mediawiki +1
Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.34.1 Description: The issue in MediaWiki is related to the lack of proper output encoding or escaping, which can be exploited by a remote attacker to impact data integrity. Users can add various Cascading Style...
ConEmu - Customizable Windows Terminal With Tabs, Splits, Quake-Style, Hotkeys And More
ConEmu-Maximus5 is a Windows console emulator with tabs, which represents multiple consoles as one customizable GUI window with various features. Initially, the program was created as a companion to Far Manager, my favorite shell replacement - file and archive management, command history and...
CVE-2020-6813
When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker to inject arbitrary styles, bypassing the intent of the Content Security Policy. This vulnerability affects Firefox 74...
