Microsoft Edge Security Breach

Microsoft Edge is a web browser from Microsoft Corporation USA that comes with systems after Windows 10. A security vulnerability exists in Microsoft Edge. The following products and editions are affected: Microsoft Edge EdgeHTML-based in Windows 10 Version 20H2 for 32-bit Systems, Microsoft Edge...

CVE-2020-35719

Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/Applications/Search/index.jsp file via the added parameter. NOTE: This vulnerability only affects products that are no longer supported by...

Cross site scripting

Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the ReportPreview.do file via the referer parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

Cross site scripting

Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the Error.jsp file via the err parameter or indirectly via the cpr, tcp, or abs parameter. NOTE: This vulnerability only affects products that are no...

CVE-2020-35726

Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/Applications/Reports/index.jsp file via the by parameter. NOTE: This vulnerability only affects products that are no longer supported by t...

UBUNTU-CVE-2020-16033

Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof security UI via a crafted HTML page...

CVE-2019-20484

An issue was discovered in Viki Vera 4.9.1.26180. A user without access to a project could download or upload project files by opening the Project URL directly in the browser after logging in...

CVE-2020-25797

LimeSurvey 3.21.1 is affected by cross-site scripting XSS in the Add Participants Function First and last name parameters. When the survey participant being edited, e.g. by an administrative user, the JavaScript code will be executed in the browser...

Cross site scripting

Cross-site scripting XSS issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link...

The vulnerability of the Google Chrome web browser’s exchange buffer allows a hacker to execute arbitrary code.

The vulnerability of Google Chrome’s web browser exchange buffer is related to overflow in the dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Adobe Experience Manager 跨站脚本漏洞

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

Mozilla: Variable time processing of cross-origin images during drawImage calls

Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Design/Logic Flaw

An issue was discovered on Fujitsu Eternus Storage DX200 S4 devices through 2020-11-25. After logging into the portal as a root user using any web browser, the portal can be accessed with root privileges when the URI cgi-bin/csp?cspid=XXXXXXXXXX&csppage=cgiPgOverview&csplang=en is visited from a...

The vulnerability in the V8 engine of Google Chrome browser allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the V8 engine implementation in Google Chrome browser is related to writing beyond the buffer boundaries of memory. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information through a...

U.S. Dept Of Defense: Reflected XSS on https://███/████via hidden parameter "█████████"

Hi everyone : I found a Reflected XSS on https://█████/█████████via hidden parameter "██████████". Steps To Reproduce: - Use your favorite web browser - Go to : https://█████/████████&██████=XXX%22%3E%3Cscript%3Ealert%27Reflected%20XSS%20here%27%3C/script%3E An XSS is triggered ! The initial page...

Arbitrary Code Execution Vulnerability in Multiple Apple Products

Apple Safari is a web browser that is the default browser that comes with the Mac OS X and iOS operating systems.Apple iOS is an operating system developed for mobile devices.Apple iTunes for Windows is a Windows-based media player application.... Apple iTunes for Windows is a media player...

CVE-2020-7363

User Interface UI Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions...

CVE-2020-7364

User Interface UI Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions...

chromium-browser: Insufficient data validation in webUI

Insufficient data validation in webUI in Google Chrome on ChromeOS prior to 86.0.4240.75 allowed a local attacker to bypass content security policy via a crafted HTML page...

The vulnerability of the Google Chrome and Sailfish Browser rendering process allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the Google Chrome and Sailfish Browser rendering process is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker, operating remotely, to cause a service failure or execute arbitrary code by deleting the current embedded HTML obje...