6063 matches found
mariadb: save_window_function_values triggers an abort during IN subquery
savewindowfunctionvalues in MariaDB before 10.6.3 allows an application crash because of incorrect handling of withwindowfunc=true for a subquery...
CVE-2022-1583
The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null" when links to external sites are clicked, which may enable tabnabbing attacks to occur...
CVE-2022-1582
The External Links in New Window / New Tab WordPress plugin before 1.43 does not properly escape URLs it concatenates to onclick event handlers, which makes Stored Cross-Site Scripting attacks possible...
CVE-2022-1583
The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null" when links to external sites are clicked, which may enable tabnabbing attacks to occur...
WordPress plugin External Links in New Window / New Tab 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
WordPress plugin New Window / New Tab 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions of WordPress New Window/New Tab plugin prior to 1.43. T...
The vulnerability of the Windows DWM library in the Microsoft Windows operating system, which allows attackers to escalate their privileges
The vulnerability of the Windows DWM library in the Microsoft Windows operating system is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window...
The vulnerability in the notification interface of the fullscreen UI of Firefox browsers, Firefox ESR, and the Thunderbird email client allows attackers to perform spoofing attacks.
The vulnerability of the notification interface in the fullscreen UI mode of Firefox web browsers, Firefox ESR, and the Thunderbird email client is related to an error that occurs when reusing existing pop-up windows. Exploiting this vulnerability allows a remote attacker to carry out spoofing...
Mozilla: Fullscreen notification bypass using popups
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when reusing existing popups; Firefox allowed them to cover the fullscreen notification UI, which possibly enabled browser spoofing attacks...
new packages: matchbox-window-manager
An update is available for matchbox-window-manager. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the...
PT-2022-38204
Name of the Vulnerable Software and Affected Versions macOS Monterey versions prior to 12.4 Description An issue with state handling allows a person with physical access to a Mac to bypass the Login Window. Recommendations Update to macOS Monterey 12.4...
GHSA-99HJ-PPG3-2XWC Cross-Site Request Forgery in Jenkins
A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready t...
CVE-2021-46788
Third-party pop-up window coverage vulnerability in the iConnect module.Successful exploitation of this vulnerability may cause system pop-up window may be covered to mislead users to perform incorrect operations...
Privilege escalation
Third-party pop-up window coverage vulnerability in the iConnect module.Successful exploitation of this vulnerability may cause system pop-up window may be covered to mislead users to perform incorrect operations...
CVE-2021-46788
CVE-2021-46788 is documented as a Huawei EMUI/Magic UI vulnerability affecting the iConnect module where third-party pop-up overlays can be overridden, potentially misleading users into performing incorrect actions. Connected records identify Huawei EMUI and Magic UI as affected on Android platfo...
CVE-2022-28873
A vulnerability affecting F-Secure SAFE browser was discovered. An attacker can potentially exploit Javascript window.open functionality in SAFE Browser which could lead address bar spoofing attacks...
F-Secure SAFE 安全漏洞
F-Secure SAFE is a suite of antivirus software from the Finnish company F-Secure. A security vulnerability exists in F-Secure SAFE that originates in the Javascript window.open function that leads to an address bar spoofing attack...
CVE-2022-20007
In startActivityForAttachedApplicationIfNeeded of RootWindowContainer.java, there is a possible way to overlay an app that believes it's still in the foreground, when it is not, due to a race condition. This could lead to local escalation of privilege with no additional execution privileges neede...