UBUNTU-CVE-2017-5464

During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

UBUNTU-CVE-2017-5403

When adding a range to an object in the DOM, it is possible to use "addRange" to add the range to an incorrect root object. This triggers a use-after-free, resulting in a potentially exploitable crash. This vulnerability affects Firefox 52 and Thunderbird 52...

CVE-2016-5193

Google Chrome prior to 54.0 for iOS had insufficient validation of URLs for windows open by DOM, which allowed a remote attacker to bypass restrictions on navigation to certain URL schemes via crafted HTML pages...

UBUNTU-CVE-2016-5207

In Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android, corruption of the DOM tree could occur during the removal of a full screen element, which allowed a remote attacker to achieve arbitrary code execution via a crafted HTML page...

Microsoft Internet Explorer 11 MSHTML CView::CalculateImageImmunity Use-After-Free

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the second entry in that series. The below information is also available on my blog at http://blog.skylined.nl/20161102001.html. There you can find a repro that...

Microsoft Internet Explorer 11 - MSHTML CView::CalculateImageImmunity Use-After-Free

var oDocumentFragment = document.createDocumentFragment, oElement = document.createElement'x'; oDocumentFragment.appendChildoElement; oElement.style.listStyleImage = "urlx"; oDocumentFragment.removeChildoElement; !-- Exploit I tried a few tricks to see if there was an easy way to reallocate the...

The vulnerability of the Firefox browser allows a malicious attacker to compromise the confidentiality and integrity of protected information.

The vulnerability in the implementation of XrayWrapper in Mozilla Firefox allows malicious actors to bypass access restrictions by using a specially crafted web page, provided that the user visits it through a debugger. This enables operations such as unwrapping and calling DOM methods on unwrapp...

The vulnerability of Google Chrome browser allows a malicious individual to execute arbitrary code or trigger a service denial.

The Google Chrome browser contains a vulnerability related to errors in memory management after the release of memory in the StyleElement::removedFromDocument function in core/dom/StyleElement.cpp of Blink for Google Chrome. Exploiting this vulnerability allows malicious actors to cause system...

The vulnerability of Google Chrome browser allows a malicious actor to trigger a service failure.

The Google Chrome browser contains a vulnerability related to incorrect checking of the render state during the focus event in the object model of the document DOM implementation of Blink for Google Chrome. Exploiting this vulnerability allows malicious actors to cause service failures or otherwi...

Symantec Endpoint Protection Manager and Client Design Vulnerability

Symantec Endpoint Protection SEP is a suite of antivirus software from Symantec Corporation. The software provides security across physical and virtual systems.SEP Manager and Client are the management and client software. A design flaw exists in the management console of Symantec Endpoint...

The vulnerability of Google Chrome browser allows a violator to circumvent existing access restrictions policies.

The vulnerability of the Google Chrome browser’s DOM component is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to circumvent existing access control policies by using a specially crafted website...

Google Chrome DOM Homology Policy Bypass Vulnerability (CNVD-2016-01234)

Google Chrome is a popular web browser. Google Chrome's DOM implementation process fails to properly handle the execution order of frame-attach and frame-detach operations, allowing remote attackers to build specially crafted Web sites to bypass the same-origin policy...

jenkins: password exposure in DOM (SECURITY-138)

Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for the password field of a parameterized job by reading the DOM...

The vulnerabilities of PDF viewing and editing programs like Adobe Reader, Document Cloud, Adobe Reader, and Adobe Acrobat allow attackers to execute arbitrary code.

The vulnerability of the Doc object implementation in PDF file viewing and editing programs like Adobe Reader, Document Cloud, Adobe Reader, and Adobe Acrobat is related to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code...

Google Blink DOM Homology Policy Bypass Vulnerability

Blink is the United States Google Google Inc. and Norway Opens Opera Software company jointly developed a set of browser layout engine rendering engine. A security vulnerability exists in the DOM implementation of Blink used in versions of Google Chrome prior to 47.0.2526.73, which stems from the...

UBUNTU-CVE-2015-6770

The DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-6768...

chromium-browser: Cross-origin bypass in DOM

The DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-6768...

Google Chrome DOM Homology Bypass Vulnerability

Google Chrome is a WEB-based browser. A vulnerability in the Google Chrome Blink implementation allows remote attackers to construct malicious WEB pages that can be tricked into parsing by users, which can bypass the same-origin policy and execute special script code...

chromium-browser: Cross-origin bypass in DOM

The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not check whether a node is expected, which allows remote attackers to bypass the Same Origin Policy or cause a denial of service DOM tree corruption via a web...

The vulnerability of the Firefox browser, which allows a hacker to execute arbitrary code on the client side

The vulnerability of the CSPService::ShouldLoad function in Firefox browsers is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code on the client side by manipulating the DOM objects...