Arbitrary command execution on Windows via qutebrowserurl: URL handler

Impact Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers it as a handler for certain URL schemes. With some applications such as Outlook Desktop, opening a specially crafted URL can lead to argument injection, allowing execution of qutebrowser commands, which in tu...

Unfixed XSS vulnerability at www.it3.mtr.com.hk

Security researcher Alan Ho from VXRL, has submitted on 12/12/2011 a cross-site-scripting XSS vulnerability affecting www.it3.mtr.com.hk, which at the time of submission ranked 32872 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/12/2011. I...

Unfixed XSS vulnerability at www.three.com.hk

Security researcher Anthony Lai from VXRL, has submitted on 12/12/2011 a cross-site-scripting XSS vulnerability affecting www.three.com.hk, which at the time of submission ranked 40830 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/12/2011...