CVE-2018-8469

An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser, aka "Microsoft Edge Elevation of Privilege Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8463...

Mozilla Firefox Memory Corruption Vulnerability (CNVD-2018-21819)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox. A remote attacker can exploit the vulnerability to cause memory corruption or possibly execute arbitrary code...

A Bug in Chrome Gives Bad Actors License to Play ‘20 Questions’ with Your Private Data

In a 2013 interview with The Telegraph, Eric Schmidt, then CEO of Google was quoted as saying: “You have to fight for your privacy or lose it.” Five years later, with the ‘Cambridge Analytica’ data breach scandal fresh in our memory, Eric Schmidt’s statement rings as a self-evident truth. Similar...

Google Chrome URL Spoofing Vulnerability (CNVD-2018-17054)

Google Chrome is a web browser developed by the American company Google Google. A URL spoofing vulnerability exists in Omnibox in Google Chrome. A remote attacker can exploit this vulnerability to spoof URLs by tricking users into visiting specially crafted websites...

Google Chrome heap buffer overflow vulnerability (CNVD-2018-17049)

Google Chrome is a web browser developed by the American company Google Google. A heap buffer overflow vulnerability exists in WebGL in Google Chrome. An attacker can exploit the vulnerability to execute arbitrary code in the browser context...

Google Chrome memory misreference vulnerability (CNVD-2018-17042)

Google Chrome is a web browser developed by the American company Google Google. A memory misreference vulnerability exists in WebRTC in Google Chrome. An attacker can exploit the vulnerability to execute arbitrary code in the browser context...

Code injection

In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to execute and expose information from the...

The vulnerability of the Mozilla Firefox browser, related to the lack of protection for service data, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Mozilla Firefox browser is related to the lack of protection for service data. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

Microsoft Edge Information Disclosure Vulnerability (CNVD-2018-12879)

Edge is Microsoft's browser for Windows 10. Microsoft Edge suffers from an information disclosure vulnerability. The vulnerability stems from Microsoft Edge failing to properly handle objects in memory. An attacker could exploit the vulnerability to obtain information that could further compromis...

Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CNVD-2018-12892 )

Edge is Microsoft's browser for Windows 10. A memory corruption vulnerability exists in Microsoft Edge. The vulnerability stems from a problem with the way the Chakra scripting engine in Microsoft Edge handles objects in memory. An attacker could exploit the vulnerability to execute arbitrary cod...

CVE-2018-9335

The PAN-OS session browser in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier, and PAN-OS 8.1.1 and earlier may allow an attacker to inject arbitrary JavaScript or HTML...

Google Developer Discovers a Critical Bug in Modern Web Browsers

Google researcher has discovered a severe vulnerability in modern web browsers that could have allowed websites you visit to steal the sensitive content of your online accounts from other websites that you have logged-in the same browser. Discovered by Jake Archibald, developer advocate for Googl...

CVE-2017-5464

During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

CVE-2017-5434

A use-after-free vulnerability occurs when redirecting focus handling which results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

Code injection

A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an attacker to spoof an existing page without the malicious page's address being displayed correctly. This vulnerability affects Firefox 52...

CVE-2017-5422

CVE-2017-5422 describes a denial-of-service crash triggered by repeatedly using the view-source: protocol within a single hyperlink. The issue affects Mozilla Firefox and Thunderbird prior to version 52. The root cause is tied to how the view-source: protocol was handled in a chained hyperlink, a...

Design/Logic Flaw

i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted user input can use the name of one of the dictionary keys to inject script into the browser. This affects i18next =1.10.2...

HPE UCMDB Configuration Manager Software Cross-Site Scripting Vulnerability

HPE UCMDB full name Universal CMDB is the United States Hewlett Packard Enterprise HPE company's set of resource management solutions. The solution provides from the bottom up including IT infrastructure auto-discovery, data modeling, service mapping definition and service impact analysis, etc...

Malicious Package

Overview Version 0.0.3 of jasmin contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.0.3 of this module is found installed you...

CVE-2018-9111

Cross Site Scripting XSS exists on the Foxconn FEMTO AP-FC4064-T APGTB385.8.3lb15-W47 LTE Build 15 via the configuration of a user account. An attacker can execute arbitrary script on an unsuspecting user's browser...