webkitgtk: A malicious website may exfiltrate data cross-origin

A vulnerability was found in WebKit. This flaw allows a remote attacker to exfiltrate data cross-origin by convincing a victim to visit a specially crafted website, which results in obtaining sensitive information...

webkitgtk: A malicious website may cause unexpected cross-origin behavior

A flaw was found in WebKit. This flaw allows a remote attacker to trigger unexpected cross-origin behavior via a malicious website...

EyouCMS 代码问题漏洞

EyouCMS is an open source content management system CMS based on ThinkPHP by China's Eyou. A code issue vulnerability exists in EyouCMS version 1.5.6, which stems from an unrestricted file upload issue contained in the Website Logo Handler component...

The vulnerability of Adobe Experience Manager’s content and media data management system, which stems from the lack of measures taken to protect the structure of web pages, allows attackers to carry out XSS attacks.

The vulnerability of Adobe Experience Manager’s content and media data management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

The vulnerability of the OpenSearch software package lies in the ability to redirect users to unreliable websites, allowing attackers to redirect users to malicious sites.

The vulnerability of the OpenSearch software package is related to the redirection of URLs to an unreliable website. Exploiting this vulnerability allows a malicious actor to redirect users to a malicious website remotely...

The vulnerability of the Alert Rules function in the network monitoring system LibreNMS allows attackers to perform cross-site scripting attacks.

The vulnerability of the Alert Rules function in the LibreNMS network monitoring system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Microsoft Office 2016 Multiple Vulnerabilities (KB5002642)

This host is missing an important security update according to Microsoft KB5002642 SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

webkitgtk: A malicious website may exfiltrate data cross-origin

A vulnerability was found in WebKit. This flaw allows a remote attacker to exfiltrate data cross-origin by convincing a victim to visit a specially crafted website, which results in obtaining sensitive information...

webkitgtk: Visiting a malicious website may lead to address bar spoofing

A flaw was found in WebKit. This flaw allows a remote attacker to conduct spoofing attacks by exploiting an inconsistent user interface issue. The attacker could perform address bar spoofing by tricking a victim into visiting a specially crafted website...

The vulnerability of the Portal for ArcGIS web portal, related to the lack of protective measures for the website structure, allows attackers to carry out cross-site scripting attacks and gain full control over the application.

The vulnerability of the Portal for ArcGIS is related to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks and gain full control over the application through a specially created web page...

Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: webkitgtk: Visiting a malicious website may lead to address bar spoofing CVE-2024-40866 webkitgtk: A malicious website may exfiltrate data cross-origin CVE-2024-44187 webkitgtk: webkit2gtk:...

webkit: processing malicious web content may lead to a denial of service

A flaw was found in WebKit. This issue may allow an attacker to trigger a denial of service condition by convincing a victim to visit a specially crafted website...

webkit: visiting a malicious website may lead to address bar spoofing

A flaw was found in WebKit that may allow a remote attacker to conduct spoofing attacks by exploiting an inconsistent user interface issue. By tricking a victim into visiting a specially crafted website, the attacker could perform address bar spoofing...

I transformed my English-language site avleonov.com

I transformed my English-language siteavleonov.com. While my Russian-language site avleonov.ru was intended as a mirror of my Telegram channel @avleonovrus, I wasn't sure how to move forward with the English-language site. I've been running it since 2016. For a long time, it was my main VM blog...

.NET 6.0 Update - November 12, 2024 (KB5047486)

None None...

CVE-2024-51485

Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating plugins. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change...

CVE-2024-51484

CVE-2024-51484 concerns Ampache, a web-based audio/video streaming app. The issue is in how the platform validates CSRF tokens during activation/deactivation of controllers: the token parsing/validation path does not properly secure these state-changing requests, enabling CSRF-style abuse to togg...

CVE-2024-51487 Insufficient Validation in Catalog (Activation/Deactivation) in Ampache

Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating catalog. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change...

CVE-2024-51487

CVE-2024-51487 — Ampache CSRF token validation issue : Multiple connected sources confirm a vulnerability in Ampache where the token parsing/CSRF validation does not correctly handle activation/deactivation of catalog (and related directory actions). This flaw could allow an attacker to trigger C...

CVE-2024-50237

creationtimestamp| type| source ---|---|--- 2024-11-09 11:49:36+00:00| seen| https://infosec.exchange/users/cve/statuses/113452841447399084 2025-08-14 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07...