CVE-2018-6068

Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

med-ed.virginia.edu XSS vulnerability

Open Bug Bounty ID: OBB-562978 Description| Value ---|--- Affected Website:| med-ed.virginia.edu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Inside the MSRC– The Monthly Security Update Releases

For the second in this series of blog entries we want to look into which vulnerability reports make it into the monthly release cadence. It may help to start with some history. In September 2003 we made a change from a release anytime approach to a mostly predictable, monthly release cadence...

About the security content of Safari 11 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

macOS Kernel - Use-After-Free Due to Lack of Locking in AppleEmbeddedOSSupportHostClient::registerNo

Exploit for macOS platform in category dos / poc / AppleEmbeddedOSSupportHost.kext is presumably involved in the communication with the OS running on the touch bar on new MBP models. Here's the userclient's registerNotificationPort method: text:0000000000002DE4 ;...

macOS Kernel - Use-After-Free Due to Lack of Locking in 'AppleEmbeddedOSSupportHostClient::registerNotificationPort'

/ AppleEmbeddedOSSupportHost.kext is presumably involved in the communication with the OS running on the touch bar on new MBP models. Here's the userclient's registerNotificationPort method: text:0000000000002DE4 ; AppleEmbeddedOSSupportHostClient::registerNotificationPortipcport , unsigned int,...

CVE-2017-15389

An insufficient watchdog timer in navigation in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2017-15386

Incorrect implementation in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

Information disclosure

Incorrect implementation in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

UBUNTU-CVE-2017-15389

An insufficient watchdog timer in navigation in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2017-15389

An insufficient watchdog timer in navigation in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2017-15386

The CVE-2017-15386 issue affects the Blink component in Google Chrome prior to 62.0.3202.62, where an incorrect implementation could allow a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. The connected sources corroborate that this is a UI/content spoofing vulnerability i...

CVE-2017-15389

CVE-2017-15389 is a URL-spoofing vulnerability in the Omnibox (URL bar) of Chromium/Google Chrome prior to 62.0.3202.62. The root cause is an insufficient watchdog timer in navigation, enabling a remote attacker to spoof the contents of the Omnibox via a crafted HTML page. Affected software inclu...

chromium-browser: url spoof in omnibox

Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

Mozilla: URL spoofing with right-to-left text aligned left-to-right (MFSA 2018-03)

If right-to-left text is used in the addressbar with left-to-right alignment, it is possible in some circumstances to scroll this text to spoof the displayed URL. This issue could result in the wrong URL being displayed as a location, which can mislead users to believe they are on a different sit...

Mozilla Firefox Domain Forgery Vulnerability

Mozilla Firefox for OS X is an open source web browser based on the OS X platform from the Mozilla Foundation in the U.S. Firefox ESR for OS X is an extended support version of Firefox based on the OS X platform. A security vulnerability exists in previous versions of Mozilla Firefox 58 for OS X,...

USN-3544-1 firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, spoof the origin in audio capture prompts, trick the user in to providing HTTP...

Mozilla: URL spoofing with right-to-left text aligned left-to-right (MFSA 2018-03)

If right-to-left text is used in the addressbar with left-to-right alignment, it is possible in some circumstances to scroll this text to spoof the displayed URL. This issue could result in the wrong URL being displayed as a location, which can mislead users to believe they are on a different sit...

CVE-2018-5117

If right-to-left text is used in the addressbar with left-to-right alignment, it is possible in some circumstances to scroll this text to spoof the displayed URL. This issue could result in the wrong URL being displayed as a location, which can mislead users to believe they are on a different sit...

Improved Control Over the Remote Language Bar for Seamless Published Applications

Introduction This feature enhancement first appears in the XenApp and XenDesktop 7.17 Product Release. Code changes to support this feature were required in Windows VDA version 7.17 and Receiver for Windows 4.11. Using the Receiver for Windows UI, users can now configure whether they want to...