CVE-2017-5394

A location bar spoofing attack where the location bar of loaded page will be shown over the content of another tab due to a series of JavaScript events combined with fullscreen mode. Note: This issue only affects Firefox for Android. Other operating systems are not affected. This vulnerability...

Code injection

A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendered. This would allow a malicious site to displayed a spoofed addressbar, showing the location of an arbitrary website instead of the one loaded. Note: this...

CVE-2017-7770

A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendered. This would allow a malicious site to displayed a spoofed addressbar, showing the location of an arbitrary website instead of the one loaded. Note: this...

CVE-2017-7770: Improper Input Validation

A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendered. This would allow a malicious site to displayed a spoofed addressbar, showing the location of an arbitrary website instead of the one loaded. Note: this...

CVE-2017-5394: Cross-Site Request Forgery (CSRF)

A location bar spoofing attack where the location bar of loaded page will be shown over the content of another tab due to a series of JavaScript events combined with fullscreen mode. Note: This issue only affects Firefox for Android. Other operating systems are not affected. This vulnerability...

PT-2018-8427

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 54 Description A mechanism in Firefox for Android allows a malicious site to display a spoofed addressbar when entering fullscreen mode after loading a new tab through JavaScript events. This enables the malicious sit...

PT-2018-8246

Name of the Vulnerable Software and Affected Versions: Firefox for Android versions prior to 51 Description: The issue is a location bar spoofing attack that occurs when a series of JavaScript events are combined with fullscreen mode, causing the location bar of a loaded page to be shown over the...

CVE-2013-2885

Use-after-free vulnerability in Google Chrome before 28.0.1500.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to not properly considering focus during the processing of JavaScript events in the presence of a multiple-fields...

CVE-2013-2885

Use-after-free vulnerability in Google Chrome before 28.0.1500.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to not properly considering focus during the processing of JavaScript events in the presence of a multiple-fields...

Design/Logic Flaw

Use-after-free vulnerability in Google Chrome before 28.0.1500.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to not properly considering focus during the processing of JavaScript events in the presence of a multiple-fields...

CVE-2013-2885

CVE-2013-2885 affects Google Chrome (Chromium-based) prior to 28.0.1500.95. It is a use-after-free in input handling related to focus during processing of JavaScript events with a multiple-fields input type, enabling remote denial of service and possibly other impact. Public advisories (Debian/Ma...

CVE-2013-2885

Use-after-free vulnerability in Google Chrome before 28.0.1500.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to not properly considering focus during the processing of JavaScript events in the presence of a multiple-fields...

CVE-2013-2885

Removed by vendor...

PT-2013-4005

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 28.0.1500.95 Description A use-after-free issue exists, potentially allowing remote attackers to cause a denial of service or have other unspecified impacts. This issue is related to the improper handling of foc...

CVE-2013-2885: Undefined Security Weakness

Use-after-free vulnerability in Google Chrome before 28.0.1500.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to not properly considering focus during the processing of JavaScript events in the presence of a multiple-fields...

CVE-2012-6565

Cross-site scripting XSS vulnerability in REDCap before 4.14.3 allows remote authenticated users to inject arbitrary web script or HTML via uppercase characters in JavaScript events within user-defined labels...

Cross site scripting

Cross-site scripting XSS vulnerability in REDCap before 4.14.3 allows remote authenticated users to inject arbitrary web script or HTML via uppercase characters in JavaScript events within user-defined labels...

CVE-2012-6565

Cross-site scripting XSS vulnerability in REDCap before 4.14.3 allows remote authenticated users to inject arbitrary web script or HTML via uppercase characters in JavaScript events within user-defined labels...

PT-2013-2019

Name of the Vulnerable Software and Affected Versions REDCap versions prior to 4.14.3 Description A cross-site scripting issue allows remote authenticated users to inject arbitrary web script or HTML via uppercase characters in JavaScript events within user-defined labels. Recommendations For...

CVE-2012-6565: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in REDCap before 4.14.3 allows remote authenticated users to inject arbitrary web script or HTML via uppercase characters in JavaScript events within user-defined labels...