PoC_CVE-2017-0807

CVE-2017-0807 개념 증명 이것은 Efthimios Alepis와 Constantinos Patsakis가 보고한 CVE-2017-0807에 대해 의도적으로 조잡한 인터페이스를 가진 데모 애플리케이션입니다. 이 취약점은 Nougat까지의 모든 Android 버전에서 보안 문제로 인해 권한이 없는 사용자가 거의 모든 Android 인터페이스를 오버레이하여 사용자를 속여 입력을 유도할 수 있음을 보여줍니다. 데모에서는 앱을 기기 관리자로 만드는 화면을 오버레이하지만, 이 취약점을 악용할 수 있는 다른 많은 방법이 있습니다...

CVE-2020-0096-StrandHogg2

이 설계 결함으로 인해 공격자는 다른 애플리케이션 위에 자신의 액티비티페이지를 표시하여 사용자가 자신의 개인 데이터를 잃어버리게 할 수 있습니다. 이 취약점은 StrandHogg 2.0으로 알려져 있으며, 최근 노르웨이 보안 회사 Promon에 의해 공개되었습니다. 범위: 이론적으로는 전체 버전 android10 테스트는 실패했고, 8.0.1 테스트는 성공했습니다. 검증 단계: 대상 앱의 패키지 이름과 exported 액티비티로 코드 수정 대상 앱의 대상 액티비티 시작 테스트 앱 시작 대상 앱 시작 시 하이재킹 성공 확인 링크...

GHSA-FFMG-HFVG-JHG9 Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav

Summary Grav 2.0.0-rc.9 and the current 2.0 branch still allow stored CSS injection through Markdown image media actions. The prior media hardening rejects direct ?style= payloads and unsafe attribute fallbacks, but the adjacent resize action still writes caller-controlled values directly into...

EUVD-2026-42267

Grav: Stored CSS injection via Markdown image resize bypasses prior media style sanitizers in Grav...

CVE-2026-58657

Grav before 2.0.0 affected through 2.0.0-rc.9 and the 2.0 branch contains a stored CSS injection vulnerability in the Markdown image resize media action. Prior media hardening rejects direct ?style= payloads and unsafe attribute fallbacks, but the resize action in Excerpts::processMediaActions...

CVE-2021-40834

A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a specially crafted seemingly legitimate URL SAFE browser goes into full screen and hides the user interface. A remote attacker can leverage this to perform spoofing attack...

CVE-2021-40834: Improper Restriction of Rendered UI Layers or Frames

A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a specially crafted seemingly legitimate URL SAFE browser goes into full screen and hides the user interface. A remote attacker can leverage this to perform spoofing attack...

Mozilla: Cursor spoofing could overlay user interface when native cursor is zoomed

It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

Mozilla: Cursor spoofing could overlay user interface when native cursor is zoomed

It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

Mozilla: Cursor spoofing could overlay user interface when native cursor is zoomed

It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

Mozilla: Cursor spoofing could overlay user interface when native cursor is zoomed

It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

UPchieve: Clickjacking ar https://hackers.upchieve.org/login

I found clickjacking at login page on https://hackers.upchieve.org that can be exploited if the UI overlay can be performed correctly by the attacker. Clickjack test page Website is vulnerable to clickjacking! Click me when you finish : Impact Its login page so if the UI overlay can be performed...

Mozilla: Custom cursor can overlay user interface

When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. Thi...

Design/Logic Flaw

In functionality implemented in System UI, there are insufficient protections implemented around overlay windows. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0...

UBUNTU-CVE-2017-5083

Inappropriate implementation in Blink in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote attacker to display UI on a non attacker controlled tab via a crafted HTML page...

Privilege escalation

An elevation of privilege vulnerability in the System UI could enable a local malicious application to create a UI overlay covering the entire screen. This issue is rated as Moderate because it is a local bypass of user interaction requirements that would normally require either user initiation o...

CVE-2017-0492: Improper Restriction of Rendered UI Layers or Frames

An elevation of privilege vulnerability in the System UI could enable a local malicious application to create a UI overlay covering the entire screen. This issue is rated as Moderate because it is a local bypass of user interaction requirements that would normally require either user initiation o...

firefox security update

CentOS Errata and Security Advisory CESA-2007:0079 Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web...