Mozilla: Fullscreen notification bypass via windowName

The Mozilla Foundation Security Advisory describes this flaw as: Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks...

Mozilla: Fullscreen notification bypass

The Mozilla Foundation Security Advisory describes this flaw as: Through a series of popup and window.print calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks...

Mozilla: Fullscreen notification bypass via windowName

The Mozilla Foundation Security Advisory describes this flaw as: Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks...

Privilege Escalation

github.com/aws/amazon-cloudwatch-agent is vulnerable to privilege escalation. The vulnerability exists when a user triggers a repair of the Agent which results in a pop-up window opening with SYSTEM permissions on Windows, allowing an attacker with administrative access to create a new command...

USN-5775-1: Vim vulnerabilities

It was discovered that Vim uses freed memory in recurisve substitution of specially crafted patterns. An attacker could possbly use this to crash Vim and cause denial of service. CVE-2022-2345 It was discovered that Vim makes illegal memory calls when patterns start with an illegal byte. An...

IBM OPENBMC OP910 安全漏洞

IBM OPENBMC OP910 is a POWER8 and POWER9 emulator from International Business Machines IBM. A security vulnerability exists in IBM OPENBMC OP910 and OP940 that originates from allowing a privileged user to cause a denial of service by uploading or deleting too many CA certificates in a short peri...

DEBIAN-CVE-2022-23468

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol RDP. xrdp v0.9.21 contain a buffer over flow in xrdploginwndcreate function. There are no known workarounds for this issue. Users are advised to upgrade...

UBUNTU-CVE-2022-23468

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol RDP. xrdp v0.9.21 contain a buffer over flow in xrdploginwndcreate function. There are no known workarounds for this issue. Users are advised to upgrade...

UBUNTU-CVE-2022-23484

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol RDP. xrdp v0.9.21 contain a Integer Overflow in xrdpmmprocessrailupdatewindowtext function. There are no known workarounds for this issue. Users are advised to upgrade...

xrdp 输入验证错误漏洞

xrdp is an open source remote desktop protocol server from Neutrinolabs Labs. An input validation error vulnerability exists in versions prior to xrdp v0.9.21, which stems from the inclusion of an integer overflow in the xrdpmmprocessrailupdatewindowtext function...

xrdp 安全漏洞

xrdp is an open source remote desktop protocol server from Neutrinolabs Labs. A security vulnerability exists in xrdp versions prior to v0.9.21, which stems from the inclusion of a buffer overflow in the xrdploginwndcreate function...

SAMSUNG Mobile devices 授权问题漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile devices versions prior to SMR Dec-2022 Release 1, which stems from incorrect authentication of the...

PT-2022-27976 · Unknown · Paddlepaddle

Name of the Vulnerable Software and Affected Versions: PaddlePaddle version 2.4.0-rc0 Description: The issue allows for code injection in the paddle.audio.functional.get window function, enabling arbitrary code execution. Recommendations: For PaddlePaddle version 2.4.0-rc0, consider applying the...

Arbitrary Command Execution

Overview Affected versions of this package are vulnerable to Arbitrary Command Execution. An attacker could modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious...

CVE-2022-23465

SwiftTerm is a Xterm/VT100 Terminal emulator. Prior to commit a94e6b24d24ce9680ad79884992e1dff8e150a31, an attacker could modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing...

PT-2022-16007 · Swiftterm · Swiftterm

Name of the Vulnerable Software and Affected Versions: SwiftTerm versions prior to a94e6b24d24ce9680ad79884992e1dff8e150a31 Description: The issue allows an attacker to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's...

SwiftTerm 安全漏洞

SwiftTerm is a VT100/Xterm terminal emulator library for Swift applications from the individual developer Miguel de Icaza. SwiftTerm suffers from a security vulnerability that stems from the fact that an attacker can modify the window title with a specific character escape sequence and then inser...

xorg security update

CentOS Errata and Security Advisory CESA-2022:8491 An update for xorg-x11-server is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

PT-2022-27677

Name of the Vulnerable Software and Affected Versions PaddlePaddle versions prior to 2.4 Description The issue arises from the paddle.audio.functional.get window function calling eval on a user-supplied winstr, leading to potential code injection and arbitrary code execution. Recommendations For...

PaddlePaddle 代码注入漏洞

PaddlePaddle Flying Paddle is an independent R&D deep learning platform open-sourced by China's Flying Paddle PaddlePaddle. PaddlePaddle 2.4 has a security vulnerability , the vulnerability stems from its paddle.audio.functional.getwindow component in the user-supplied winstr call eval allows an...