CVE-2019-5827

Integer overflow in SQLite via WebSQL in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

DEBIAN-CVE-2019-5814

Insufficient policy enforcement in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

UBUNTU-CVE-2019-5823

Insufficient policy enforcement in service workers in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...

chromium-browser: parameter passing error in media player leading to unauthorized access

Parameter passing error in media in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

chromium-browser: Integer overflow in PDFium

Integer overflow in PDFium in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file...

chromium-browser: CORS bypass in download manager

Inappropriate implementation in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass same origin policy via a crafted HTML page...

Google Chrome Media Player Out-of-Bounds Access Vulnerability

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in the media player in versions prior to Google Chrome 74.0.3729.131. An attacker can exploit this vulnerability by tricking a user into visiting a specially crafted website to bypass security...

Google Chrome Blink System Unauthorized Access Vulnerability (CNVD-2019-23115)

Google Chrome is a Web browser from Google, a U.S. company. Blink is a browser layout engine rendering engine jointly developed by Google and Norway's OperaSoftware. An unauthorized access vulnerability exists in Blink in versions of Google Chrome prior to 74.0.3729.108. An attacker can exploit...

Google Chrome Autofill Information Disclosure Vulnerability (CNVD-2019-23114)

Google Chrome is the United States Google Google company's a Web browser. Autofill is one of the auto-fill form plug-ins. An information disclosure vulnerability exists in Autofill in versions of Google Chrome prior to 74.0.3729.108. An attacker can exploit this vulnerability to obtain user...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 74 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 74.0.3729.108 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcomin...

Remote Code Execution in esigate-core

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable vi...

CVE-2018-1000854

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable vi...

Design/Logic Flaw

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable vi...

CVE-2018-1000854

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable vi...

CVE-2018-1000854

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable vi...

CVE-2018-1000854

CVE-2018-1000854 concerns esigate.org esigate, affected up to version 5.2. The vulnerability arises from CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in the ESI directive that uses user-specified XSLT, enabling remote code execution. T...

JVN#37943805: Confluence Server vulnerable to script injection

User Macros of Confluence Server provided by Atlassian Pty Ltd. contains a script injection vulnerability CWE-74. Impact When the administrator embeds a malicious script into User Macros, the embedded script may be executed on the user's web browser. Solution Update the Software Update to the...

Cross site scripting

cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering...

CVE-2018-16236

CVE-2018-16236 affects cPanel through version 74, allowing XSS via a crafted filename in the logs subdirectory of a user account. The root cause is that the filename is mishandled during rendering of frontend/THEME/raw/index.html, enabling script injection. Exploit details (in-the-wild, vectors) ...

JVN#69967692: Multiple script injection vulnerabilities in multiple Yamaha network devices

The management screen of multiple network devices provided by Yamaha Corporation contains multiple script injection vulnerabilities CWE-74. Impact In the case where multiple administrators manage an affected device, an administrator with malicious intent may embed an arbitrary script into the...