47355 matches found
CVE-2025-53858
ChatLuck contains a cross-site scripting vulnerability in Chat Rooms. If exploited, an arbitrary script may be executed on the web browser of the user who is accessing the product...
CVE-2025-62584
Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment...
CVE-2025-62585
Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment...
CVE-2025-62583
Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment...
DNS Rebinding and Manipulating CORS Headers Enables Exfiltration of Information
Overview A vulnerability in cross-origin resource sharing CORS headers in Chromium, Google Chrome, Microsoft Edge, Safari, and Firefox enables the CORS policy to be manipulated. Combined with a DNS rebind, an attacker can send arbitrary requests to services listening on arbitrary ports regardless...
WebRTC Metadata and IP Leakage in Modern Browsers: A Cross-Platform Measurement Study
Web Real-Time Communication WebRTC enables real-time peer-to-peer communication, but its Interactive Connectivity Establishment ICE process can unintentionally expose internal and public IP addresses as metadata. This paper presents a cross-platform measurement study of WebRTC metadata leakage...
Multiple Password Managers Vulnerable to Clickjacking Attacks
Overview Browser-extension password managers, which autofill sensitive information on websites, can be exposed to various clickjacking attacks. These attacks exploit the trust relationship between a web page and the user-interface elements injected by the extension. Recent studies show that...
New Tech Support Scam Uses Microsoft Logo to Fake Browser Lock, Steal Data
The Cofense Phishing Defense Centre warns of a new tech support scam using Microsoft’s brand to lock browsers and steal data. Learn how the attack uses fake 'payment lures' and urgent security alerts to trick victims into calling a fraudulent support number...
Exploit for Type Confusion in Google Chrome
UCBrowserExploit.js Introduction All content below refer...
CVE-2025-52583
Reflected cross-site scripting XSS vulnerability in desknet's Web Server allows execution of arbitrary JavaScript in a user’s web browser...
EUVD-2025-34746
Stored cross-site scripting XSS vulnerability in desknet's NEO V2.0R1.0 to V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser...
EUVD-2025-34748
Stored cross-site scripting XSS vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser...
CVE-2025-54760
A primary security issue is a Stored cross-site scripting (XSS) vulnerability in desknet’s NEO, affecting v9.0R2.0 and earlier, which could allow arbitrary JavaScript to run in a user’s browser. The CVE is corroborated by multiple sources (NVD/Red Hat/JVN/CVE records) noting the same description....
CVE-2025-52583
The CVE-2025-52583 entry describes a Reflected cross-site scripting (XSS) vulnerability in desknet’s Web Server that allows execution of arbitrary JavaScript in a user’s browser. The connected sources confirm the issue is tied to desknet’s Web Server and identify the impact as client-side script ...
EUVD-2025-34749
Reflected cross-site scripting XSS vulnerability in desknet's Web Server allows execution of arbitrary JavaScript in a user’s web browser...
EUVD-2025-34719
Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment...
EUVD-2025-34717
Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment...
EUVD-2025-34718
Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment...