PT-2018-13130

Name of the Vulnerable Software and Affected Versions Bloop Airmail 3 version 3.5.9 Description An issue was discovered where the primary WebView instance in Bloop Airmail 3 for macOS does not properly restrict frame navigation requests from all sub-classes of HTMLFrameOwnerElements. Specifically...

Microsoft Cortana Flaw Allows Web Browsing on Locked PCs

As voice assistants like Alexa and Google Home gain traction in the smart-home market, they have also been under increased speculation around how they approach privacy. Now, researchers say they have discovered a newly-disclosed flaw in Microsoft’s Cortana assistant for Windows 10 machines that...

CVE-2017-16654

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read methods of these classes use a path and a locale to determine the...

SQL Injection Vulnerability in the ar***.php Page of the Ux365 Web Category Navigation System

Uc365 website classification and navigation system is a cross-platform open source software, based on PHP + MYSQL development and construction of open source website classification and catalog management system. Uke365 website category navigation system ar.php page SQL injection vulnerability...

chromium-browser: URL spoof in Omnibox

Incorrect handling of reloads in Navigation in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

chromium-browser: Request privilege escalation in Extensions

Insufficient data validation in Extensions API in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension...

CVE-2018-6165

Incorrect handling of reloads in Navigation in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

PT-2018-3293

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 68.0.3440.75 Description The issue is related to incorrect handling of data in the Navigation component of Google Chrome, allowing a remote attacker to spoof the contents of the Omnibox URL bar using a specially...

PT-2018-13397

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 68.0.3440.75 Description The issue is related to insufficient data validation in the Extensions API, allowing an attacker to bypass navigation restrictions via a crafted Chrome Extension, if a user is convinced ...

CVE-2018-14419

MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page...

CVE-2018-14419

MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page...

Code injection

MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page...

MetInfo Cross-Site Scripting Vulnerability (CNVD-2018-14100)

MetInfo is a content management system CMS developed using PHP and Mysql by China Mito Information Technology Ltd. A cross-site scripting vulnerability exists in MetInfo version 6.0.0. A remote attacker can inject arbitrary script or HTML by modifying the name of the navigation bar on the homepag...

CVE-2018-14419

MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page...

CVE-2018-14419

CVE-2018-14419 affects MetInfo 6.0.0, a PHP/MySQL CMS, where an XSS vulnerability is triggered by modifying the navigation bar name on the home page. The CVSS scores indicate a Network attack vector with low (v2) to medium (v3) impact and user interaction not required on v2 but UI interaction on ...

GangWang GPS Navigation Attack Leads Unsuspecting Drivers Astray

A proof-of-concept attack that uses realistic fake turn-by-turn navigation directions for in-car GPS systems has managed to fool drivers into following them a full 95 percent of the time in testing. Mobile navigation services are used by billions of users around the globe today. While GPS spoofin...

CVE-2018-14419: Improper Neutralization of Input During Web Page Generation

MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page...

PT-2018-12500

Name of the Vulnerable Software and Affected Versions MetInfo version 6.0.0 Description The issue allows for cross-site scripting XSS attacks via a modified name of the navigation bar on the home page. Recommendations For MetInfo version 6.0.0, update to a newer version that contains a fix for th...

CVE-2018-2919

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Unified Navigation. Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2018-2919

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Unified Navigation. Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...