Re: [FD] Checking existence of firewalled URLs via javascript's script.onload

Hi Georgi, As you suggested, this is a CSRF attack. Using such techniques to attack or enumerate local applications has been known for some time and is a very difficult issue to address. Browsers have done well in preventing malicious _authenticated_ cross-site requests, but as you've found, at

[FD] Mr. Post - Outlook Add-in - Data Theft Risk

Mr. Post is an Outlook add-in used for inspecting emails for threats. Its tagline states "One click to visualize email. Unveil scam, phishing, ransom and BEC (Business Email Compromise)." The add-in is featured prominently in the Outlook Add-in store, including those on iOS and Android. It’s pos

[FD] Windows Defender Application Guard DoS via Long Hostname

Windows Defender Application Guard (also known as "WDAG", Microsoft Defender Application Guard, and "MDAG") can be closed by any script or website loaded in WDAG by redirecting the browser to a URL with a long hostname (e.g, 10,000 characters long). This can cause a denial-of-service condition.

[FD] Fancy Product Designer for WooCommerce - Unrestricted File Upload

## About Fancy Product Designer for WooCommerce Fancy Product Designer for WooCommerce is a WordPress plugin which allows users to design custom products in a vendor's WooCommerce store. It is sold through the third-party marketplace "Envato Market" and boasts over 15,000 sales. ## Unrestricted

[FD] Fancy Product Designer for WooCommerce - Stored XSS via SVG upload

## About Fancy Product Designer for WooCommerce Fancy Product Designer for WooCommerce is a WordPress plugin which allows users to design custom products in a vendor's WooCommerce store. It is sold through the third-party marketplace "Envato Market" and boasts over 15,000 sales. ## Stored XSS vi