CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 0CVE-2021-44749 – Universal Cross-Site Scripting Vulnerability in F-Secure SAFE Browser Protection for Android
https://notcve.org/view.php?id=CVE-2021-44749
06 Mar 2022 — A vulnerability affecting F-Secure SAFE browser protection was discovered improper URL handling can be triggered to cause universal cross-site scripting through browsing protection in a SAFE web browser. User interaction is required prior to exploitation. A successful exploitation may lead to arbitrary code execution. Se ha detectado una vulnerabilidad que afecta a la protección del navegador F-Secure SAFE. Un manejo inapropiado de las URLs puede causar una vulnerabilidad de tipo cross-site scripting univer... • https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-44749 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-44748 – Universal Cross-Site Scripting Vulnerability in F-Secure SAFE Browser for Android
https://notcve.org/view.php?id=CVE-2021-44748
06 Mar 2022 — A vulnerability affecting F-Secure SAFE browser was discovered whereby browsers loads images automatically this vulnerability can be exploited remotely by an attacker to execute the JavaScript can be used to trigger universal cross-site scripting through the browser. User interaction is required prior to exploitation, such as entering a malicious website to trigger the vulnerability. Se ha detectado una vulnerabilidad que afecta al navegador F-Secure SAFE por la que los navegadores cargan imágenes automátic... • https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-44748 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.6EPSS: 0%CPEs: 1EXPL: 0CVE-2021-40835 – URL Address Bar Spoofing in F-Secure SAFE Browser for iOS
https://notcve.org/view.php?id=CVE-2021-40835
16 Dec 2021 — An URL Address bar spoofing vulnerability was discovered in Safe Browser for iOS. When user clicks on a specially crafted a malicious URL, if user does not carefully pay attention to url, user may be tricked to think content may be coming from a valid domain, while it comes from another. This is performed by using a very long username part of the url so that user cannot see the domain name. A remote attacker can leverage this to perform url address bar spoofing attack. The fix is, browser no longer shows th... • https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-40834 – User interface Spoofing in F-Secure SAFE browser for Android
https://notcve.org/view.php?id=CVE-2021-40834
10 Dec 2021 — A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a specially crafted seemingly legitimate URL SAFE browser goes into full screen and hides the user interface. A remote attacker can leverage this to perform spoofing attack. Se ha detectado una vulnerabilidad de superposición de la interfaz de usuario en F-secure SAFE Browser para Android. Cuando el usuario hace clic en una URL aparentemente legítima especialmente diseñada, el navegador SAFE pasa a... • https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33594 – F-Secure Safe browser for Android vulnerable to Address Bar Spoofing
https://notcve.org/view.php?id=CVE-2021-33594
11 Aug 2021 — An address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially crafted a malicious URL, it appears like a legitimate one on the address bar, while the content comes from other domain and presented in a window, covering the original content. A remote attacker can leverage this to perform address bar spoofing attack. Se ha detectado una vulnerabilidad de suplantación de la barra de direcciones en Safe Browser para Android. Cuando el usuario hace clic en una U... • https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33595 – F-Secure Safe browser for iOS vulnerable to Address Bar Spoofing
https://notcve.org/view.php?id=CVE-2021-33595
11 Aug 2021 — A address bar spoofing vulnerability was discovered in Safe Browser for iOS. Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit domain. A remote attacker can leverage this to perform address bar spoofing attack. Se ha detectado una vulnerabilidad de suplantación de la barra de direcciones en Safe Browser para iOS. • https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame •
CVSS: 4.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33596 – Fake Apple login prompt in F-Secure SAFE browser for iOS
https://notcve.org/view.php?id=CVE-2021-33596
05 Aug 2021 — Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit domain. Exploiting the vulnerability requires the user to click on a specially crafted, seemingly legitimate URL containing an embedded malicious redirect while using F-Secure Safe Browser for iOS. Mostrar la URL legítima en la barra de direcciones mientras se carga el contenido de otro dominio. Esto hace creer al usuario que el contenido es servido por... • https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 1CVE-2020-14977
https://notcve.org/view.php?id=CVE-2020-14977
23 Jun 2020 — An issue was discovered in F-Secure SAFE 17.7 on macOS. The XPC services use the PID to identify the connecting client, which allows an attacker to perform a PID reuse attack and connect to a privileged XPC service, and execute privileged commands on the system. NOTE: the attacker needs to execute code on an already compromised machine. Se detectó un problema en F-Secure SAFE versión 17.7 en macOS. Los servicios XPC usan el PID para identificar al cliente que se conecta, lo que permite a un atacante llevar ... • https://theevilbit.github.io/posts •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 1CVE-2020-14978
https://notcve.org/view.php?id=CVE-2020-14978
23 Jun 2020 — An issue was discovered in F-Secure SAFE 17.7 on macOS. Due to incorrect client version verification, an attacker can connect to a privileged XPC service, and execute privileged commands on the system. NOTE: the attacker needs to execute code on an already compromised machine. Se detectó un problema en F-Secure SAFE versión 17.7 en macOS. Debido a una verificación de versión de cliente incorrecta, un atacante puede conectarse a un servicio XPC privilegiado y ejecutar comandos privilegiados en el sistema. • https://theevilbit.github.io/posts •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2019-11644
https://notcve.org/view.php?id=CVE-2019-11644
17 May 2019 — In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6, F-Secure Client Security Standard and Premium before 14.10, F-Secure PSB Workstation Security before 12.01, and F-Secure Computer Protection Standard and Premium before 19.3, a local user can escalate their privileges through a DLL hijacking attack against the installer. The installer writes the file rm.exe to C:\Windows\Temp and then executes it. The rm.exe process th... • https://www.f-secure.com/en/web/labs_global/fsc-2019-2 • CWE-427: Uncontrolled Search Path Element •