#dom-based-clickjacking
#dom-based-clickjacking
[ follow ]
#cybersecurity #vulnerability #vulnerabilities #malware #remote-code-execution #supply-chain-attack #ai #firefox
React
fromThisweekinreact
1 day agoThis Week In React #278: React Email, TSRX, ESLint plugin, Rspack RSC, TanStack, Hook Form | Vision Camera, Expo, Nano Icons, ExecuTorch, Argent, Audio API, CSS, RNSec | TypeScript Go, Node.js, Bun, Hono | This Week In React
React Email 6.0 consolidates the ecosystem, offering an embeddable editor and improved HTML rendering for better email management.
fromMouse Vs Python
5 days agoTextual - An Intro to DOM Queries (Part I) - Mouse Vs Python
The query_one() method throughout the Textual documentation allows users to retrieve a single widget that matches a CSS selector or a widget type. You can pass in up to two parameters to query_one(), which are the CSS selector and the widget type, or both at the same time.
jQuery
fromTNW | Anthropic
10 hours agoInformation security
Mozilla fixes 271 Firefox vulnerabilities found by Anthropic's Claude Mythos in a single evaluation pass
Mozilla's Firefox 150 fixes 271 security vulnerabilities identified by Anthropic's AI model, Mythos, showcasing the model's effectiveness in vulnerability detection.
#cybersecurity
Information security
fromTechRepublic
11 hours agoHackers Impersonate IT Help Desk on Microsoft Teams to Gain Access, Steal Data
Hackers are increasingly using social engineering on Microsoft Teams to gain unauthorized access by impersonating IT support.
Information security
fromTNW | Next-Featured
1 day agoLovable security crisis: 48 days of exposed projects, closed bug reports, & the structural failure of vibe coding security
Lovable's security incidents expose vulnerabilities in AI-generated code and highlight a market focus on growth over security.
Web development
fromMozilla Hacks - the Web developer blog
1 month agoGoodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148 - Mozilla Hacks - the Web developer blog
Firefox 148 introduces the standardized Sanitizer API, enabling developers to safely remove malicious HTML and JavaScript from user-generated content before inserting it into the DOM.
Information security
fromSecurityWeek
1 month agoPolyfill Supply Chain Attack Impacting 100k Sites Linked to North Korea
The 2024 Polyfill.io supply chain attack affecting over 100,000 websites involved both Chinese and North Korean threat actors, with Funnull serving as a corporate front for the operation.
Information security
fromThe Hacker News
1 month agoCritical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials
Two critical vulnerabilities in n8n workflow automation platform enable arbitrary command execution through sandbox escape and unauthenticated expression evaluation, affecting both self-hosted and cloud deployments.
fromCSS-Tricks
1 month agoAn Exploit ... in CSS?! | CSS-Tricks
Google credits security researcher Shaheen Fazim with reporting the exploit to Google. The dude's LinkedIn says he's a professional bug hunter, and I'd say he deserves the highest possible bug bounty for finding something that a government agency is saying "in CSS in Google Chrome before 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page."
Information security
fromBleepingComputer
1 month agoFake Next.js job interview tests backdoor developer's devices
The Microsoft Defender team says that the attacker created fake web app projects built with Next.js and disguised them as coding projects to share with developers during job interviews or technical assessments. The researchers initially identified a repository hosted on the Bitbucket cloud-based Git-based code hosting and collaboration service. However, they discovered multiple repositories that shared code structure, loader logic, and naming patterns.
Information security
[ Load more ]