Cisco Orbital Open Redirect Vulnerability

A vulnerability in the web-based management interface of Cisco Orbital could allow an unauthenticated, remote attacker to redirect users to a malicious webpage. This vulnerability is due to improper validation of URL paths in the web-based management interface. An attacker could exploit this...

CVE-2021-34772

A vulnerability in the web-based management interface of Cisco Orbital could allow an unauthenticated, remote attacker to redirect users to a malicious webpage. This vulnerability is due to improper validation of URL paths in the web-based management interface. An attacker could exploit this...

Cisco Orbital 输入验证错误漏洞

Cisco Orbital is a service from Cisco that adds Osquery to Secure Endpoint to support detailed and fast queries from incident responders. An input validation error vulnerability exists in the web-based management interface of Cisco Orbital, which stems from incorrect validation of URL paths in th...

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge browsers allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to operations performed outside of the buffer boundaries. Exploiting this vulnerability can allow a malicious actor to cause service failures or execute arbitrary code through a specially created web page...

The vulnerability of the Adobe Bridge file manager arises from insufficient validation of input data, allowing a malicious actor to redirect users to a malicious web page remotely.

The vulnerability of the Adobe Bridge file manager, related to insufficient validation of input data, allows a malicious actor to redirect users to a malicious web page remotely...

Apple Safari 缓冲区错误漏洞

Apple Safari is a web browser from Apple Inc. and is the default browser that comes with the Mac OS X and iOS operating systems. Apple Safari suffers from a buffer error vulnerability that originates from a boundary error when processing HTML content in WebKit. A remote attacker could use this...

Vulnerabilities fixed in Apple iOS, iPadOS and macOS

Vulnerabilities have been fixed in iOS, iPadOS and macOS. A malicious party could potentially exploit the vulnerability to execute arbitrary code. To exploit the vulnerabilities a user must open a rogue PDF document or visit Web page visit. Apple indicates that these vulnerabilities may be active...

CVE-2021-25463

Improper access control vulnerability in PENUP prior to version 3.8.00.18 allows arbitrary webpage loading in webview...

Improper access control

Improper access control vulnerability in PENUP prior to version 3.8.00.18 allows arbitrary webpage loading in webview...

CVE-2021-25463

Improper access control vulnerability in PENUP prior to version 3.8.00.18 allows arbitrary webpage loading in webview...

PT-2021-16653 · Penup · Penup

Name of the Vulnerable Software and Affected Versions: PENUP versions prior to 3.8.00.18 Description: The issue is related to improper access control, allowing arbitrary webpage loading in webview. This could potentially lead to unauthorized access or malicious activities. Recommendations: For...

UBUNTU-CVE-2021-30604

Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

CVE-2021-33884

An Unrestricted Upload of File with Dangerous Type vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows remote attackers to upload any files to the /tmp directory of the device through the webpage API. This can result in critical files being overwritten...

U.S. Dept Of Defense: Open Akamai ARL XSS at ████████

Summary There is Open Akamai ARL XSS at ████████ Proof-of-Concept http://████/7/0/33/1d/www.citysearch.com/search?what=Binit&where=Binit%22%3E%3Cimg%20src%3Dbinit%20onerror%3Dalert%28document.domain%29%3E References: - https://github.com/war-and-code/akamai-arl-hack -...

Language Bar Flags <= 1.0.8 - CSRF to Stored XSS

The plugin does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This could allow attackers to make a logged in admin change the settings, and set Cross-Site Scripting payload in them, which will be executed in t...

Updated webkit2 packages fix security vulnerabilities

Updated webkit2 packages fix security vulnerabilities: A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory corruption. In order to...

Cross site scripting

CTparental before 4.45.03 is vulnerable to cross-site scripting XSS in the CTparental admin panel. In blcategireshelp.php, the 'categories' variable is assigned with the content of the query string param 'cat' without sanitization or encoding, enabling an attacker to inject malicious code into th...

CVE-2021-22676

UserExcelOut.asp within WebAccess/SCADA is vulnerable to cross-site scripting XSS, which could allow an attacker to send malicious JavaScript code. This could result in hijacking of cookie/session tokens, redirection to a malicious webpage, and unintended browser action on the WebAccess/SCADA...

The vulnerability of the File System API interfaces of Google Chrome and Microsoft Edge allows a hacker to execute arbitrary code.

The vulnerability of the File System API interfaces in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code through a specially created web page...

Mozilla Firefox和Mozilla Thunderbird输入验证错误漏洞

Mozilla Firefox and Mozilla Thunderbird are both products of the Mozilla Foundation in the U.S. Mozilla Firefox is an open source Web browser. Mozilla Thunderbird is a separate set of email client software. The software supports IMAP and POP email protocols as well as HTML email formats. Mozilla...