chromium-browser: content security policy bypass

Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially bypass content security policy via a crafted HTML page...

Debian DSA-4103-1 : chromium-browser - security update

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2017-15420 Drew Springall discovered a URL spoofing issue. - CVE-2017-15429 A cross-site scripting issue was discovered in the v8 JavaScript library. - CVE-2018-6031 A use-after-free issue was discovered in the pdfium...

Google Chrome for Mac, Windows and Linux Security Bypass Vulnerability (CNVD-2018-03794)

Google Chrome for Mac, Windows and Linux is a web browser developed by Google, Inc. for the Mac, Windows and Linux platforms. A security vulnerability exists in versions of Google Chrome prior to 64.0.3282.119 for Windows, Mac and Linux platforms. A remote attacker can exploit the vulnerability t...

Cisco Content Security Management Appliance Privilege Escalation Vulnerability

According to its self-reported version, the Cisco Content Security Management Appliance SMA is affected by a privilege escalation vulnerability. Please see the included Cisco BIDs and the Cisco Security Advisory for more information. TRUSTED...

CVE-2018-6040

Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially bypass content security policy via a crafted HTML page...

Google Chrome Security Updates (stable-channel-update-for-desktop_24-2018-01) - Windows

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

CVE-2018-0095

A vulnerability in the administrative shell of Cisco AsyncOS on Cisco Email Security Appliance ESA and Content Security Management Appliance SMA could allow an authenticated, local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential wi...

CVE-2018-0095

CVE-2018-0095 affects Cisco Email Security Appliance (ESA) and Content Security Management Appliance (SMA). A locally authenticated attacker with at least guest privileges can exploit an incorrect networking configuration in the administrative shell CLI to escalate to root. Cisco released advisor...

CVE-2018-0095

A vulnerability in the administrative shell of Cisco AsyncOS on Cisco Email Security Appliance ESA and Content Security Management Appliance SMA could allow an authenticated, local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential wi...

Cisco ESA and Content SMA Elevation of Privilege Vulnerabilities

Cisco Email Security Appliances ESAs are email security gateway products designed to detect and block a variety of email-borne threats, such as malware, spam, and phishing attacks.The Cisco Content Security Management Appliance SMA centralizes multiple Cisco email and network security appliances'...

Cisco Email Security and Content Security Management Appliance Privilege Escalation Vulnerability

A vulnerability in the administrative shell of the Cisco Email Security Appliance ESA and Content Security Management Appliance SMA could allow an authenticated, local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential with at least a...

Trend Micro Control Manager ContentSecuritySummary SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Control Manager. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

GLSA-201801-03 : Chromium, Google Chrome: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201801-03 Chromium, Google Chrome: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the CVE identifiers referenced below for details. Impact : A remote attacker...

Chromium, Google Chrome: Multiple vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices Description Multiple vulnerabilities have been discovered in Chromium and...

The vulnerability of Google Chrome’s Blink rendering module allows a hacker to obtain values of the URL fragments.

The vulnerability of Google Chrome’s Blink rendering module is related to errors in the Content Security Policy CSP reporting mechanism. Exploiting this vulnerability allows a malicious actor to obtain fragment values from URLs through a specially crafted HTML page...

Uber: udi-id Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint

Summary The udi-id request parameter at the https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js mobile endpoint is copied into a javascript string encapsulated in double quotation marks, resulting in SSL-protected payloads being reflected unmodified in the application's response. The script-src whitelis...

Uber: muber-id Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint

Summary The muber-id request parameter at the https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js mobile endpoint is copied into a javascript string encapsulated in double quotation marks, resulting in SSL-protected payloads being reflected unmodified in the application's response. The script-src...

Uber: lite:sess Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint

Summary The lite:sess request parameter at the https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js mobile endpoint is copied into a javascript string encapsulated in double quotation marks, resulting in SSL-protected payloads being reflected unmodified in the application's response. The script-src...

Uber: SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint

Summary The ga request parameter at the https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js mobile endpoint is copied into a javascript string encapsulated in double quotation marks, resulting in SSL-protected payloads being reflected unmodified in the application's response. The script-src whitelist at...

Uber: SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint

Summary The cc request parameter at the https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js mobile endpoint is copied into a javascript string encapsulated in double quotation marks, resulting in SSL-protected payloads being reflected unmodified in the application's response. The script-src whitelist at...