CVE-2023-34414

The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page elicited user clicks in precise locations immediately before navigating to a sit...

Mozilla: Click-jacking certificate exceptions through rendering lag

The Mozilla Foundation Security Advisory describes this flaw as: The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page elicited user...

Cross-Site Scripting (XSS)

backstage is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to not sanitizing catalog content which allows an attacker to inject script urls in the entities stored in the catalog, which results in XSS when a user clicks on the entry...

ASP.NET Core Elevation Of Privilege Vulnerability

An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests. An attacker who successfully exploited this vulnerability could perform content injection attacks and run script in the security...

Adobe Connect Clickjacking Vulnerability

Adobe Connect is an online video conferencing software. A clickjacking vulnerability exists in Adobe Connect 9.6.2 and earlier versions. A remote user can exploit the vulnerability to hijack a target user's mouse clicks to act as the target user to perform actions on a website and obtain...

Vulnerability in Apple Safari Could Allow Information Disclosure

Executive Summary Microsoft is providing notification of the discovery and remediation of a vulnerability affecting Apple Safari version 5.05 and earlier. Microsoft discovered and disclosed the vulnerability under coordinated vulnerability disclosure to the affected vendor, Apple Inc. Apple Inc...

Internet Explorer 7 ClickJack

Application Name : İnternet Explorer 7 Vulnerable Type : Clickjacking Author : UzmiX function updateboxevt mouseX=evt.pageX?evt.pageX:evt.clientX; mouseY=evt.pageY?evt.pageY:evt.clientY; document.getElementById'open'.style.left=mouseX-2; document.getElementById'open'.style.top=mouseY-2;...

mfsa200539.txt

// FrSIRT Comment : If a user clicks on a link, this code will load "about:plugins" // into Firefox sidebar panel and will overwrite "browser.startup.homepage", // which will change the homepage to malicious.com Click Here First Next, Click Here...