Design/Logic Flaw

Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name...

Design/Logic Flaw

Insufficient policy enforcement in Resource Timing API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to infer browsing history by triggering a leaked cross-origin URL via a crafted HTML page...

CVE-2017-15419

Insufficient policy enforcement in Resource Timing API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to infer browsing history by triggering a leaked cross-origin URL via a crafted HTML page...

Design/Logic Flaw

Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar...

UBUNTU-CVE-2017-15426

Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name...

CVE-2017-15427

CVE-2017-15427 is a Chrome Omnibox cross-site scripting vulnerability reported as: insufficient policy enforcement in Omnibox allowed a user to XSS themselves by dragging and dropping a javascript: URL into the URL bar, affecting Chrome versions before 63.0.3239.84. Connected sources confirm the ...

CVE-2017-15425

The CVE-2017-15425 vulnerability affects Google Chrome’s Omnibox prior to 63.0.3239.84, due to insufficient policy enforcement that enables domain spoofing via IDN homographs in crafted domain names. Impact is domain spoofing risk; exploitation arises from adversaries leveraging visually similar ...

CVE-2017-15419

CVE-2017-15419 describes an information-disclosure vulnerability in Google Chrome’s Resource Timing API before 63.0.3239.84. The root cause is insufficient policy enforcement, allowing a remote attacker to leak cross-origin URLs via a crafted HTML page and infer browsing history. Affected product...

CVE-2017-15424

Google Chrome Omnibox vulnerability CVE-2017-15424: insufficient policy enforcement allows domain spoofing via IDN homographs in crafted domain names, affecting versions prior to 63.0.3239.84. Debian and other advisories indicate fix to 63.0.3239.84-1~deb9u1 and related patches; upgrade to 63.0.3...

CVE-2017-15425

Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name...

CVE-2017-15419

Insufficient policy enforcement in Resource Timing API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to infer browsing history by triggering a leaked cross-origin URL via a crafted HTML page...

CVE-2017-15426

Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name...

CVE-2017-15427

Removed by vendor...

CVE-2017-15426

Removed by vendor...

CVE-2017-15425

Removed by vendor...

CVE-2017-15424

Removed by vendor...

CVE-2017-15419

Removed by vendor...

Alleged SIM Swapper Arrested in California

Authorities in Santa Clara, Calif. have arrested and charged a 19-year-old area man on suspicion hijacking mobile phone numbers as part of a scheme to steal large sums of bitcoin and other cryptocurrencies. The arrest is the third known law enforcement action this month targeting "SIM swappers,"...

Elasticsearch ESA-2017-18

An error was found in the X-Pack Security privilege enforcement. If a user has either delete or index permissions on an index in a cluster, they may be able to issue both delete and index requests against that index. C Tenable Network Security, Inc. include"compat.inc"; if description...

Dispelling the Myths Surrounding Security Technology and GDPR

Many of our customers conducting business in Europe are concerned about how the new General Data Protection Regulation "GDPR" impacts the ability to protect their organization's data, network and IT system resources. In particular, many worry that the requirements of GDPR will restrict their...