442 matches found
VR Calendar <= 2.3.4 - Admin+ LFI
The plugin does not validate user input before using it in a require statement, which could allow high privilege users to perform LFI attacks. The attack could also be performed via a CSRF vector by making a logged in admin open a malicious link...
VR Calendar < 2.3.1 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/plugins.php?vrcmsg=msgtype="...
VR Calendar <= 2.3.4 - Admin+ LFI
The plugin does not validate user input before using it in a require statement, which could allow high privilege users to perform LFI attacks. The attack could also be performed via a CSRF vector by making a logged in admin open a malicious link PoC...
WordPress VR Calendar plugin < 2.3.1 - Unauthenticated Arbitrary Function Call vulnerability
Unauthenticated Arbitrary Function Call vulnerability discovered by Vinay Varma Mudunuri and Krishna Harsha Kondaveeti in WordPress VR Calendar plugin versions 2.3.1. Solution Update the WordPress VR Calendar plugin to the latest available version at least 2.3.1...
VR Calendar < 2.3.2 - Unauthenticated Arbitrary Function Call
The plugin lets any user execute arbitrary PHP functions on the site. PoC https://example.com/wp-admin/admin-post.php?vrccmd=phpinfo...
VR Calendar < 2.3.2 - Unauthenticated Arbitrary Function Call
The plugin lets any user execute arbitrary PHP functions on the site. https://example.com/wp-admin/admin-post.php?vrccmd=phpinfo...
Mozilla Firefox ESR Security Advisory (MFSA2022-14) - Windows
Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...
vr-akademie.de Cross Site Scripting vulnerability OBB-2720575
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Malicious code in com.unity.modules.vr (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware caa2a5f7f655d792cae0caf690a3c6670f07134ec8fb5d954fdebc12bdbe1d88 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in vr-webpack (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f88607f198a3dbe42356f35d209be7c9ca835120a80a46b993789bb3700e63e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6969 Malicious code in vr-webpack (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f88607f198a3dbe42356f35d209be7c9ca835120a80a46b993789bb3700e63e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
U.S. Warns Against North Korean Hackers Posing as IT Freelancers
Highly skilled software and mobile app developers from the Democratic People's Republic of Korea DPRK are posing as "non-DPRK nationals" in hopes of landing freelance employment in an attempt to enable the regime's malicious cyber intrusions. That's according to a joint advisory from the U.S...
vr.gesuidouten.jp Cross Site Scripting vulnerability OBB-2558218
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:1302)
The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:1302-1 advisory. - Mozilla: Use-after-free in NSSToken objects CVE-2022-1097 - Mozilla: Out of bounds write due to unexpected WebAuthN Extensions CVE-2022-28281 -...
Mozilla: Use-after-free after VR Process destruction
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash...
Use After Free
firefox-esr:sid is vulnerable to Use-after-free. The vulnerability exist in VR Process destruction which allows an attacker to cause an application crash...
CVE-2022-1196
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash...
CVE-2022-1196
After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird 91.8 and Firefox ESR 91.8...
Security Vulnerabilities fixed in Thunderbird 91.8 — Mozilla
NSSToken objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the...
Security Vulnerabilities fixed in Firefox ESR 91.8 — Mozilla
NSSToken objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the...