CVE-2017-5105

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name...

CVE-2017-5106

Chromium-based Omnibox domain spoofing vulnerability CVE-2017-5106 in Google Chrome pre-60.0.3112.78 (Mac/Windows/Linux/Android). Root cause: insufficient policy enforcement allowing IDN homograph-based domain spoofing. Impact: remote attacker could spoof domain names via crafted domain names; re...

CVE-2017-5086

CVE-2017-5086 affects Google Chrome/Chromium Omnibox. Affected: Chromium-based browsers prior to 59.0.3071.86 on Windows/Mac; root cause: domain/address spoofing via IDN homographs in Omnibox. Impact: remote attacker could spoof the address bar content. Mitigation: upgrade to 59.0.3071.86 or newe...

CVE-2017-5086

Removed by vendor...

CVE-2017-5076

Removed by vendor...

CVE-2017-5105

CVE-2017-5105 affects Chromium/Chromium-based browsers prior to version 60.0.3112.78. The issue is Insufficient Policy Enforcement in the Omnibox, allowing a remote attacker to spoof domains via IDN homographs in specially crafted domain names. Public advisories and security trackers (e.g., Arch ...

CVE-2017-5076

CVE-2017-5076 affects the Omnibox (address bar) in Chromium/Google Chrome prior to 59.0.3071.86 (Desktop) and 59.0.3071.92 (Android); a domain spoofing vulnerability via IDN homographs is disclosed, enabling a remote attacker to misrepresent a domain. Connected sources confirm this as a content s...

CVE-2017-5060

CVE-2017-5060 affects Google Chrome/Chromium Omnibox prior to version 58.0.3029.81 (desktop) and 58.0.3029.83 (Android) due to insufficient policy enforcement, enabling domain spoofing via IDN homographs in crafted domain names. Public details in connected docs verify affected Chromium releases (...

CVE-2017-5086

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.86 for Windows and Mac allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name...

CVE-2017-5076

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name...

CVE-2017-5106

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name...

CVE-2017-5106

Removed by vendor...

CVE-2017-5060

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name...

CVE-2017-5105

Removed by vendor...

CVE-2017-5060

Removed by vendor...

USN-3434-2: Libidn vulnerability

USN-3434-1 fixed a vulnerability in Libidn. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: It was discovered that Libidn incorrectly handled decoding certain digits. A remote attacker could use this issue to cause Libidn to crash, resulting in a...

CVE-2017-15390

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name...

CVE-2017-15394

Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing in permission dialogs via IDN homographs in a crafted Chrome Extension...

HackerOne: Invalid Host detection at https://hackerone.com/redirect

Hello,99 Summary: Host detection at https://hackerone.com/redirect is invalid and insecure. Description : On redirection page, host is detected and highlighted to prevent phishing attacks. But that protection is weak and can be bypassed. So an attacker can redirect victim on another host instead ...

Out of character: Homograph attacks explained

In April, Xudong Zheng, a security enthusiast based in New York, found a flaw in some modern browsers in the way they handle domain names. While Chrome, Firefox, and Opera already have security measures in place to cue users that they might be visiting a destination they thought was legitimate, a...