11477 matches found
EXNESS: Improper Implementation of SDK Allows Universal XSS in Webview Leading to Account Takeover
Affected App: Social Trading com.exness.investments App Version: - 2.45.8-release latest on PlayStore Summary: The SurveyMonkey SDK, used to collect surveys from users for analytic and informative purposes, was implemented in an insecure manner in . Particularly, the SMFeedbackActivity was...
The vulnerability of the WebView component for displaying web pages in Google Chrome allows attackers to circumvent existing security restrictions.
The vulnerability of the WebView component of Google Chrome’s browser involves errors in the implementation of security checks for standard elements. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions through a specially created HTML page...
Brave Software: XSS on internal: privileged origin through reader mode
A vulnerability in Brave iOS versions 1.32.3 and higher allowed for XSS attacks on the privileged origin internal://local through the combination of two weaknesses. The first weakness was the exposure of uuidKey through the REFERER header due to the lack of referrer header protection in the...
The vulnerability of Google Chrome’s WebView component allows a hacker to bypass existing security restrictions by using a specially created HTML page.
The vulnerability of Google Chrome’s WebView component is related to errors in the implementation of security checks for standard elements. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions through a specially created HTML page...
openSUSE 15 Security Update : opera (openSUSE-SU-2021:1488-1)
The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1488-1 advisory. - Heap buffer overflow in Skia in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had compromised the renderer process to...
Improper Verification of Communication Channel in @theia/plugin-ext
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage...
CVE-2021-41038
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage...
CVE-2021-41038
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage...
Code injection
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage...
CVE-2021-41038
The CVE-2021-41038 entry concerns the @theia/plugin-ext component of Eclipse Theia (pre-1.18.0). The issue is that Webview contents can be hijacked via postMessage(), caused by improper verification of the communication channel. This mode of exploitation could expose or modify Webview content dep...
CVE-2021-41038
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage...
Eclipse Theia 安全漏洞
Eclipse Theia is the Eclipse Foundation's set of open source IDE frameworks for desktop and web applications based on Visual Studio Code. A security vulnerability exists in the version of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, which originates from Webview content that...
CVE-2021-41038: Improper Verification of Source of a Communication Channel
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage...
Information Disclosure
chromium-browser:bionic is vulnerable to information disclosure. Inappropriate implementation in WebView in Google Chrome on Android allowed a remote attacker to leak cross-origin data via a crafted app...
CVE-2021-37990
Inappropriate implementation in WebView in Google Chrome on Android prior to 95.0.4638.54 allowed a remote attacker to leak cross-origin data via a crafted app...
DEBIAN-CVE-2021-37990
Inappropriate implementation in WebView in Google Chrome on Android prior to 95.0.4638.54 allowed a remote attacker to leak cross-origin data via a crafted app...
CVE-2021-37990
Inappropriate implementation in WebView in Google Chrome on Android prior to 95.0.4638.54 allowed a remote attacker to leak cross-origin data via a crafted app...
CVE-2021-37990
Inappropriate implementation in WebView in Google Chrome on Android prior to 95.0.4638.54 allowed a remote attacker to leak cross-origin data via a crafted app...