The vulnerability of the PictureInPicture component in Google Chrome and Microsoft Edge browsers allows attackers to perform spoofing attacks.

The vulnerability of the PictureInPicture component in Google Chrome and Microsoft Edge is related to improperly implemented security checks for standard elements. Exploiting this vulnerability allows a malicious actor to carry out spear-phishing attacks using a specially created HTML page...

SSOReady 数据伪造问题漏洞

SSOReady is an open source development tool for enterprise SSO from SSOReady Open Source. A data forgery vulnerability exists in SSOReady, which stems from the vulnerability of the affected version to XML signature bypass attacks...

PT-2024-7276 · Google +4 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 130.0.6723.69 Description: The issue is related to a type confusion error in the V8 JavaScript engine used by Google Chrome and Microsoft Edge, allowing a remote attacker to potentially exploit heap corruption...

The vulnerability of Google Chrome’s Autofill function allows a hacker to replace the user interface.

The vulnerability of Google Chrome’s Autofill function is related to information representation errors in the user interface. Exploiting this vulnerability could allow an attacker to replace the user interface through a specially created HTML page...

The vulnerability of the Blink web browser component in Google Chrome, which allows a hacker to compromise data integrity

The vulnerability of the Blink web browser component in Google Chrome relates to the lack of protective measures for the structure of the web page. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

WordPress plugin ProfileGrid 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, an American company. A post-release reuse vulnerability exists in versions of Google Chrome prior to 129.0.6668.70, which can be exploited by a remote attacker to potentially leverage heap corruption via a crafted HTML page...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in versions of Google Chrome prior to 129.0.6668.70, which can be exploited by remote attackers to perform memory access via specially crafted Hypertext Markup Language pages...

DEBIAN-CVE-2024-7019

Inappropriate implementation in UI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Apache HertzBeat 代码问题漏洞

Apache HertzBeat is a tool from the American company Apache Apache that can monitor various components. A deserialization vulnerability exists in Apache HertzBeat versions prior to 1.6.0, which stems from the insecure deserialization of serialized data received from users by the SnakeYAML library...

The vulnerability of the Reporter Widget component in the Veeam ONE monitoring software allows a attacker to execute arbitrary HTML code.

The vulnerability of the Reporter Widgets component of the Veeam ONE monitoring software lies in the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary HTML code remotely...

rexml: DoS vulnerability in REXML

An uncontrolled resource consumption vulnerability was found in REXML. When parsing an untrusted XML with many specific characters such as , it can lead to a denial of service...

Guardrails 安全漏洞

Guardrails is a Python framework open-sourced by Guardrails AI. A security vulnerability exists in Guardrails versions 0.2.9 through 0.5.0 and earlier, which stems from its improper validation of an XML file, such that if a victim loads an XML file containing malicious Python code, the code will ...

rexml: DoS vulnerability in REXML

A flaw was found in the REXML package. Reading an XML file that contains many entity expansions may lead to a denial of service due to resource starvation. An attacker can use this flaw to trick a user into processing an untrusted XML file...

rexml: DoS vulnerability in REXML

A vulnerability was found in REXML RubyGems. This package is vulnerable to denial of service DoS when parsing a deep XML structure with the same local name attribute. This vulnerability only affects tree parser API like REXML::Document.new, other parser APIs such as stream parser API and SAX2...

Cisco IOS XR 安全漏洞

Cisco IOS XR is a set of operating systems developed by Cisco USA for its network devices. A security vulnerability exists in Cisco IOS XR that stems from a lack of proper error validation of incoming XML packets...

CLSA-2024-1725650114 expat: Fix of 3 CVEs

CVE-2024-45490: reject negative length in XMLParseBuffer - CVE-2024-45491: detect integer overflow in dtdCopy on 32-bit platforms - CVE-2024-45492: detect integer overflow in nextScaffoldPart on 32-bit platforms...

DEBIAN-CVE-2024-45490

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XMLParseBuffer...

HTML injection in HTTP redirect body

...

The vulnerability in the web interface of the software requirement management tool during the development of IBM Engineering Requirements Management DOORS allows a perpetrator to gain unauthorized access to protected information or affect the accessibility of that information.

The vulnerability of the IBM Engineering Requirements Management DOORS web interface during software development is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information or...