Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-29349PUBLISHED: 2022-05-25kkFileView v4.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java.
CVE-2022-29358PUBLISHED: 2022-05-25epub2txt2 v2.04 was discovered to contain an integer overflow via the function bug in _parse_special_tag at sxmlc.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted XML file.
CVE-2022-29359PUBLISHED: 2022-05-25A stored cross-site scripting (XSS) vulnerability in /scas/?page=clubs/application_form&id=7 of School Club Application System v0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the firstname parameter.
CVE-2022-29361PUBLISHED: 2022-05-25Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body.
CVE-2022-29362PUBLISHED: 2022-05-25A cross-site scripting (XSS) vulnerability in /navigation/create?ParentID=%23 of ZKEACMS v3.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ParentID parameter.
User Rank: Author
10/23/2019 | 12:18:40 PM
All EV certificates include the authenticated identity information of the company operating the site. This authentication follows codified methodology that has proven effective in more then ten years of widespread global use. Browsers have the opportunity to dispay this information so that a user can distinguish between a real site and a crafty criminal fake.
Unfortunately, popular browsers Chrome and Firefox have chosen not to display this information. The good news for users is that they have alternatives that do. Browsers like Safari and Edge change their interface to indicate that EV authenticated information is available and allow users to view it.