Twitter-Post-Fetcher vulnerable to Use of Web Link to Untrusted Target with window.opener Access

A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file js/twitterFetcher.js of the component Link Target Handler. The manipulation leads to use of web link to untrusted target with window.opener access. It is possible ...

GHSA-M688-CX2P-RGQ9 Twitter-Post-Fetcher vulnerable to Use of Web Link to Untrusted Target with window.opener Access

A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file js/twitterFetcher.js of the component Link Target Handler. The manipulation leads to use of web link to untrusted target with window.opener access. It is possible ...

CVE-2018-25058

A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file js/twitterFetcher.js of the component Link Target Handler. The manipulation leads to use of web link to untrusted target with window.opener access. It is possible ...

CVE-2018-25058

The CVE-2018-25058 issue affects Twitter-Post-Fetcher up to version 17.x, specifically the js/twitterFetcher.js component of the Link Target Handler. The vulnerability enables a web link to an untrusted target via window.opener access and can be triggered remotely. A fix is available in version 1...

Design/Logic Flaw

A vulnerability was found in ahorner text-helpers up to 1.0.x. It has been declared as critical. This vulnerability affects unknown code of the file lib/texthelpers/translation.rb. The manipulation of the argument link leads to use of web link to untrusted target with window.opener access. The...

CVE-2020-36624

Affected software/component: ahorner text-helpers (up to 1.0.x; patch lines reference 1.1.x) with vulnerable code in lib/text_helpers/translation.rb. Root cause: manipulation of the link argument leads to use of a web link to an untrusted target with window.opener access (reverse tabnabbing style...

CVE-2020-36624 ahorner text-helpers translation.rb reverse tabnabbing

A vulnerability was found in ahorner text-helpers up to 1.0.x. It has been declared as critical. This vulnerability affects unknown code of the file lib/texthelpers/translation.rb. The manipulation of the argument link leads to use of web link to untrusted target with window.opener access. The...

CVE-2022-32287

creationtimestamp| type| source ---|---|--- 2022-11-03 15:20:31+00:00| seen| https://t.me/cibsecurity/52501 2025-08-19 21:02:27+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lwrspzx6232v...

Kingspan TMS 300 CS 授权问题漏洞

Kingspan TMS 300 CS is a water tank management system from Kingspan. Kingspan TMS 300 CS has an authorization issue vulnerability that stems from its lack of adequate access control rules, which allows an attacker to view and modify application settings by accessing a specific Uniform Resource...

PYSEC-2022-248

Streamlit is a data oriented application development framework for python. Users hosting Streamlit apps that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world readable files, and potentially othe...

CVE-2022-34307

IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can...

CVE-2022-1682

Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07. Xss can use to steal user's cookies which lead to Account takeover or do any malicious activity in victim's browser...

CVE-2022-28739

creationtimestamp| type| source ---|---|--- 2022-05-09 22:33:17+00:00| seen| https://t.me/cibsecurity/42213 2025-09-30 01:31:31+00:00| seen| https://bsky.app/profile/gcpweekly.bsky.social/post/3lzzeuxkcgj2c...

CVE-2022-24342

In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible...

CVE-2021-41445

A reflected cross-site-scripting attack in web application of D-Link DIR-X1860 before v1.10WWB09Beta allows a remote unauthenticated attacker to execute code in the device of the victim via sending a specific URL to the unauthenticated victim...

CVE-2021-42357

When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be...

PartKeepr 代码问题漏洞

PartKeepr is an inventory management software designed primarily for electronic components.PartKeepr suffers from a server-side request forgery vulnerability, which stems from the fact that the ability to upload attachments using a URL when creating a part does not validate whether a request can ...

UBUNTU-CVE-2021-45472

In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme among others can be used...

IBM Standards Processing 安全漏洞

Ibm Standards Processing Engine Ibm Transformation Extender Advanced is a document conversion software from the American company Ibm. Used to automatically convert and validate large amounts of data. A security vulnerability exists in IBM Standards Processing that stems from the engine not settin...

CVE-2021-34571

creationtimestamp| type| source ---|---|--- 2021-09-16 16:21:53+00:00| seen| https://t.me/cibsecurity/28975 2026-02-11 21:09:27+00:00| seen| https://gist.github.com/jonathan-gruber-1/49a25d08fb02011d3bf14466e69f89ba...