240 matches found
Mozilla Firefox ĺŽĺ ¨ćźć´
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from an information disclosure vulnerability that originates when the address bar and keyboard are not hidden when recording a screen via private browsing, which can be exploite...
CVE-2023-35789
An issue was discovered in the C AMQP client library aka rabbitmq-c through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line e.g., for amqp-publish or amqp-consume and are thus visible to local attackers by listing a process and its arguments...
CVE-2022-4770
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Report .prpt...
SUSE CVE-2015-1209
Use-after-free vulnerability in the VisibleSelection::nonBoundaryShadowTreeRootNode function in core/editing/VisibleSelection.cpp in the DOM implementation in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, allows remote...
SUSE CVE-2016-5127
Use-after-free vulnerability in WebKit/Source/core/editing/VisibleUnits.cpp in Blink, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code involving an @import at-rule in a Cascadin...
SUSE CVE-2017-5016
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to prevent certain UI elements from being displayed by non-visible pages, which allowed a remote attacker to show certain UI elements on a page they don't control via a crafted HTML page...
SUSE CVE-2020-12407
Mozilla Developer Nicolas Silva found that when using WebRender, Firefox would under certain conditions leak arbitrary GPU memory to the visible screen. The leaked memory content was visible to the user, but not observable from web content. This vulnerability affects Firefox 77...
GSD-2022-1007760 io_uring: calculate CQEs from the user visible value
iouring: calculate CQEs from the user visible value This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.10 by commit...
Exploit for Argument Injection in Atlassian Bitbucket
CVE-2022-36804-POC đˇď¸ Bitbucket CVE-2022-36804 unauthenticated...
Transacting in Person with Strangers from the Internet
Communities like Craigslist, OfferUp, Facebook Marketplace and others are great for finding low- or no-cost stuff that one can pick up directly from a nearby seller, and for getting rid of useful things that dont deserve to end up in a landfill. But when dealing with strangers from the Internet,...
MTN Group: Firebase credentials leak
Summary: This report is regarding the fix of 1351329. The fix is not patched fully, comments are visible to anyone and an attacker can utilize this for further attacks. Steps To Reproduce: go to : view-source:https://mpulse.mtn.ng/ search for 'Initialize Firebase' as you can see the firebase...
CVE-2022-3019
The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a valid one...
ToolJet 莿éŽć§ĺśé误ćźć´
ToolJet is an extensible low-code framework for building business applications from ToolJet. ToolJet suffers from an Access Control Error vulnerability that stems from allowing an attacker via a forgotten password token to be able to take over the account of any comment that can be seen in the...
The vulnerability of the software web interface of Cisco Webex Meetings allows a perpetrator to compromise data integrity.
The vulnerability of Cisco Webex Meetings softwareâs web interface is related to incorrect restrictions on the visible layers or frames of the user interface. Exploiting this vulnerability could allow an attacker to compromise data integrity remotely...
The vulnerability of Schneider Electric Conext ComBoxâs communication and monitoring software lies in improper restrictions on the layers or frames of the user interface that are displayed. This allows attackers to compromise the integrity of data.
The vulnerability of the microprogramming software of Schneider Electric Conext ComBox relates to incorrect restrictions on the visible layers or frames of the user interface. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...
Vulnerability of the isolated iframe environment in Firefox web browsers, Firefox ESR, and Thunderbird email client, allowing attackers to circumvent existing security restrictions
The vulnerability in the isolated iframe environment of Firefox web browsers, Firefox ESR, and the Thunderbird email client is related to an incorrect limitation on the number of visible layers or frames. Exploiting this vulnerability allows a malicious actor to bypass existing security...
CVE-2022-30597
A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field...
CVE-2022-30525 (FIXED): Zyxel Firewall Unauthenticated Remote Command Injection
Rapid7 discovered and reported a vulnerability that affects Zyxel firewalls supporting Zero Touch Provisioning ZTP, which includes the ATP series, VPN series, and the USG FLEX series including USG20-VPN and USG20W-VPN. The vulnerability, identified as CVE-2022-30525, allows an unauthenticated and...
CVE-2022-27671
A CSRF token visible in the URL may possibly lead to information disclosure vulnerability...
âA little gift for youâ SMS spam appears to come from your own phone number
If youve received a spam SMS message sent from your own phone number, dont panic. No, you werent hacked. And youre not the only one who has received such a message, which looks a bit like this: A colleague received this same spam SMS message that has been going around more frequently these past f...