Cross-site Scripting (XSS)

jquery-ui is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary script via the dialog due to a lack of sanitization...

UBUNTU-CVE-2018-16084

The default selected dialog button in CustomHandlers in Google Chrome prior to 69.0.3497.81 allowed a remote attacker who convinced the user to perform certain operations to open external programs via a crafted HTML page...

Mouse clicks are no longer sent to a remote session after user has opened Receiver preferences dialog box

When a user has opened the Citrix Receiver preferences dialog box from the Desktop viewer toolbar, all further mouse clicks are ignored by Receiver until the session is disconnected and reconnected...

December 4, 2018, update for InfoPath 2013 (KB4022181)

None None...

U.S. Dept Of Defense: XSS on www.██████ alerts and a number of other pages

Summary: If an action on ███████ results in an error, an error dialog is shown. This dialog, in certain scenarios, is vulnerable to stored XSS due to a lack of sanitization. Description: In this specific example, I'll be using a GET endpoint that attempts to delete alerts based on an ID supplied...

Design/Logic Flaw

GNOME Seahorse through 3.30 allows physically proximate attackers to read plaintext passwords by using the quickAllow dialog at an unattended workstation, if the keyring is unlocked. NOTE: this is disputed by a software maintainer because the behavior represents a design decision...

CVE-2008-7320

GNOME Seahorse through 3.30 allows physically proximate attackers to read plaintext passwords by using the quickAllow dialog at an unattended workstation, if the keyring is unlocked. NOTE: this is disputed by a software maintainer because the behavior represents a design decision...

CVE-2008-7320

GNOME Seahorse through 3.30 allows physically proximate attackers to read plaintext passwords by using the quickAllow dialog at an unattended workstation, if the keyring is unlocked. NOTE: this is disputed by a software maintainer because the behavior represents a design decision...

CVE-2008-7320

The connected Red Hat and OSV entries confirm CVE-2008-7320 affects GNOME Seahorse up to 3.30, allowing physically proximate, local attackers to read plaintext passwords from the keyring when the quickAllow dialog is used on an unattended workstation while the keyring is unlocked. The issue is de...

CVE-2018-17477

Incorrect dialog placement in Extensions in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of extension popups via a crafted HTML page...

Design/Logic Flaw

Incorrect dialog placement in Cast UI in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page...

CVE-2018-17477

Incorrect dialog placement in Extensions in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of extension popups via a crafted HTML page...

UBUNTU-CVE-2018-17477

Incorrect dialog placement in Extensions in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of extension popups via a crafted HTML page...

CVE-2018-17476

Incorrect dialog placement in Cast UI in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page...

CVE-2018-17476

Incorrect dialog placement in Cast UI in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page...

Design/Logic Flaw

Incorrect dialog placement in Extensions in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of extension popups via a crafted HTML page...

CVE-2018-17471

Incorrect dialog placement in WebContents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page...

UBUNTU-CVE-2018-17471

Incorrect dialog placement in WebContents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page...

CVE-2018-17477

CVE-2018-17477 affects Chromium/Google Chrome extensions UI: a UI spoofing vulnerability in the extensions pane allows a remote attacker to spoof extension popups via a crafted page. Root cause is a UI spoofing vulnerability in the Extensions component present before version 70.0.3538.67. Exploit...

CVE-2018-17477

Incorrect dialog placement in Extensions in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of extension popups via a crafted HTML page...