The vulnerabilities of browsers Firefox, Firefox ESR, and the email client Thunderbird involve memory usage after it is freed. This allows attackers to compromise data integrity, gain unauthorized access to protected information, and cause service failures.

The vulnerabilities of Firefox browsers, Firefox ESR, and the Thunderbird email client are related to the use of a certain data structure after it is freed upon deletion of the list manager currently in use. Exploiting these vulnerabilities allows an attacker who operates remotely to gain access ...

Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CNVD-2019-36635)

Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. Microsoft Edge suffers from a memory corruption vulnerability in the Chakra scripting engine. The vulnerability stems from a problem in the way the Chakra scripting engine handles objects...

PT-2019-4082 · Microsoft · Browsers +2

Name of the Vulnerable Software and Affected Versions: Microsoft Browsers affected versions not specified Description: A spoofing issue exists due to improper parsing of HTTP content by Microsoft Browsers. This could allow a remote attacker to exploit the issue by crafting special HTTP queries,...

The vulnerability of the SVG object processing mechanism in browsers such as Firefox ESR, Firefox, and the email client Thunderbird allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the SVG object processing mechanism in browsers such as Firefox ESR, Firefox, and the email client Thunderbird is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause service interruptions...

Cross-Site Scripting (XSS)

com.liferay.journal.taglib is vulnerable to cross-site scripting XSS. Lack of HTML encoding allows a remote attacker to inject arbitrary Javascript into a victim's browser via the title of the journal...

Lenovo XClarity Administrator Cross-Site Scripting Vulnerability (CNVD-2019-34807)

Lenovo XClarity Administrator LXCA is a centralized resource management solution from Lenovo, China. The product is capable of providing agentless hardware management for servers, storage, network switches, and more. A cross-site scripting vulnerability exists in Lenovo XClarity Administrator. An...

Vanilla: XSS through chat messages

vulnerability name: cross site scripting through chat messages vulnerability description: cross site scripting is a vulnerability that allows an attacker to send malicious codeusually in javascript form to another user Because a browser cannot know if the script should be trusted or not, it will...

chromium-browser: Insufficient checks on filesystem: URI permissions

Insufficient policy enforcement in storage in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page...

Google Chrome Security Bypass Vulnerability (CNVD-2019-26517)

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in versions of Google Chrome prior to 76.0.3809.87. An attacker can exploit this vulnerability by tricking a user into visiting a specially crafted website to bypass security restrictions and gain...

CVE-2019-11702

A hyperlink using protocols associated with Internet Explorer, such as IE.HTTP:, can be used to open local files at a known location with Internet Explorer if a user approves execution when prompted. Note: this issue only occurs on Windows. Other operating systems are unaffected.. This...

CVE-2019-1104

A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corruption Vulnerability'...

Kartpay: Application Error disclosure, Verification token seen error and user able to change password

Summary: Application Error disclosure, Verification token seen error and user able to change password Browsers Verified In: Broswer version: Google Chrome is up to date Version 75.0.3770.100 Official Build 64-bit Steps To Reproduce: add details for how we can reproduce the issue Steps to reproduc...

The vulnerability of Microsoft Edge’s JavaScript script handler allows a hacker to execute arbitrary code.

The vulnerability of Microsoft Edge’s JavaScript script handler is related to errors in memory object handling. Exploiting this vulnerability allows a malicious actor to execute arbitrary code via a specially crafted web page...

Design/Logic Flaw

An issue was discovered in Open Ticket Request System OTRS 7.0.x through 7.0.7, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36. An attacker could send a malicious email to an OTRS system. If a logged-in agent user quotes it, the email could cause the browser to...

Microsoft Edge Buffer Overflow Vulnerability (CNVD-2019-27395)

Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. A buffer overflow vulnerability exists in the way the Chakra scripting engine handles memory objects in Microsoft Edge. An attacker could exploit this vulnerability to execute arbitrary...

Design/Logic Flaw

Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection. In other words, a third-party application can read the user's cleartext browser history via an app.provider.query...

Mozilla: Stealing of cross-domain images using canvas

Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird 60.7, Firefox 67, and Firefox ESR 60.7...

The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser allows a hacker to execute arbitrary code.

The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser is related to errors in memory object handling. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser, related to errors in memory object handling, allows a hacker to execute arbitrary code.

The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser is related to errors in processing objects in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user...

CVE-2019-12383

Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to detect the browser's UI locale by measuring a button width, even if the user has a "Don't send my language" setting...