#xss

[ follow ]
#dpop #oauth-20 #security #key-management #cybersecurity #vulnerability #chrome-extension #data-theft #pdf-security
Information security
fromInfoQ
1 day ago

The DPoP Storage Paradox: Why Browser-Based Proof-of-Possession Remains an Unsolved Problem

DPoP binds tokens to client keys but lacks guidance on browser key storage, creating security vulnerabilities that must be addressed by practitioners.
fromThe Hacker News
1 month ago

Claude Extension Flaw Enabled Zero-Click XSS Prompt Injection via Any Website

"The flaw allowed any website to silently inject prompts into that assistant as if the user wrote them. No clicks, no permission prompts. Just visit a page, and an attacker completely controls your browser."
Information security
Information security
fromSecurityWeek
2 months ago

Vulnerabilities in Popular PDF Platforms Allowed Account Takeover, Data Exfiltration

Critical and high-severity vulnerabilities were found in Apryse and Foxit PDF platforms that could enable account takeover, data exfiltration, and remote code execution.
Information security
fromZero Day Initiative
4 months ago

Zero Day Initiative - The December 2025 Security Update Review

Adobe released five bulletins addressing 139 CVEs—mostly XSS in Experience Manager—with Critical DOM-based XSS and a priority-1 ColdFusion fix; Microsoft released 56 Windows CVEs.
[ Load more ]