Johnny-You-Are-Fired

Johnny-You-Are-Fired USENIX 논문의 아티팩트 | 전체 논문 여기 초록 OpenPGP와 S/MIME는 이메일을 암호화하고 디지털 서명하기 위한 두 가지 주요 표준이다. 디지털 서명은 메시지의 진위성과 무결성을 보장하기 위한 것이다. 이 연구에서 우리는 OpenPGP 및 S/MIME 이메일 서명 검증의 다양한 구현에 대한 실질적인 위조 공격을 다섯 가지 공격 클래스로 보여준다: 1 우리는 S/MIME 컨테이너 형식의 엣지 케이스를 분석한다. 2 우리는 가장 널리 사용되는 OpenPGP 구현인 GnuPG API...

CVE-2023-38873-G1

🚨 G1 = A05:2021 – 보안 구성 오류 ClickJacking ⚠️ 기본 점수: 6.5 중간 척도: CVSS ⚠️ 📌 설명 이 저장소는 G1 사이트에 존재하는 Clickjacking 유형의 보안 취약점을 시연합니다. 이 취약점으로 인해 공격자는 사이트를 iframe 안에 로드하여 사용자를 속이기 위한 악성 요소를 겹쳐 표시할 수 있습니다. ⚠️ Clickjacking이란? ClickjackingUI Redressing이라고도 함은 사용자가 인지하지 못하는 사이에 합법적인 페이지와 상호작용하도록 속이는 공격입니다. 이는...

CVE-2026-74951

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Clickjacking issue in Firefox for Android...

CVE-2026-18534 Address bar spoofing risk in affected iOS versions of Arc Search

ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk...

UBUNTU-CVE-2026-74951

Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154...

UBUNTU-CVE-2026-74975

Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...

CVE-2026-74951

Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154...

CVE-2026-74980

CVE-2026-74980 is a clickjacking vulnerability affecting the Downloads component in Firefox for Android . The vulnerability has been addressed in Firefox 154 . Documentation confirms this issue was part of a broader set of security fixes (MFSA 2026-74) and has been reported in the wild according ...

CVE-2026-74980

Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...

CVE-2026-74978

Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

PT-2026-77008

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 154 Description A spoofing issue exists within the Downloads component, which could allow an attacker to deceive users by misrepresenting the source or nature of a downloaded file. Recommendations Update t...

PT-2026-77013

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 154 Description A clickjacking issue exists in the Downloads component. Clickjacking is a technique where an attacker uses multiple transparent or semi-transparent layers to trick a user into clicking on a...

PT-2026-69267

Name of the Vulnerable Software and Affected Versions Nexter Blocks versions prior to 5.0.2 Description Insufficient access control in a REST endpoint allows users with the Contributor role or higher to save arbitrary global CSS. This stored CSS is rendered site-wide on the front end, which can...

CVE-2026-44767 Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection

setThemeRoot failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a element, even when no tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL...

CVE-2026-33406

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js,...

CVE-2026-33406

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js,...

CVE-2026-33406 Pi-hole has a Stored HTML attribute injection

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js,...

CVE-2026-33406: Improper Neutralization of Input During Web Page Generation

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js,...

CVE-2026-31873

Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe safe.ts uses String.includes, which is case-sensitive. Browsers treat URI schemes case-insensitively. DATA:text/css,... is the same as data:text/css,... to the browser, but 'DATA:...'.includes'data...

CVE-2026-31873

Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe safe.ts uses String.includes, which is case-sensitive. Browsers treat URI schemes case-insensitively. DATA:text/css,... is the same as data:text/css,... to the browser, but 'DATA:...'.includes'data...