session hijacking news
3 stories
Webmail CSS Attacks Expose a New Risk for AI-Powered Email Tools
A security researcher has demonstrated a series of webmail client vulnerabilities that leverage Cascading Style Sheets (CSS) to steal credentials, hijack sessions, and manipulate AI tools integrated with user inboxes. The research, conducted by Gareth Heyes of PortSwigger, details attack chains against major webmail services including Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL…
Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw
Researchers have reported the discovery of 84 previously unknown vulnerabilities affecting the core networks of 4G and 5G mobile systems. These flaws, collectively termed 'iTrue' vulnerabilities, are described as stemming from implicit trust errors between various network functions within the core infrastructure. The report indicates that these issues could potentially be exploited to…
Writer AI Flaw Could Let Agent Previews Leak Session Tokens Across Tenants
A critical security vulnerability in the enterprise generative AI platform Writer has been patched, addressing a flaw that could have allowed agent previews to leak session tokens and potentially lead to cross-tenant compromise. The issue, identified as a session isolation flaw, posed a significant risk to organizations utilizing the platform for their AI-driven operations.