CVE-2021-37997

Use after free in Sign-In in Google Chrome prior to 95.0.4638.69 allowed a remote attacker who convinced a user to sign into Chrome to potentially exploit heap corruption via a crafted HTML page...

CVE-2021-37997

CVE-2021-37997 affects Chromium’s Sign-In path: a use-after-free in the Sign-In component allows remote code execution via a crafted HTML page, with heap corruption as the underlying issue. Affected versions are Chromium before 95.0.4638.69. Mitigation: upgrade to 95.0.4638.69 or newer (as reflec...

CVE-2021-37997

Use after free in Sign-In in Google Chrome prior to 95.0.4638.69 allowed a remote attacker who convinced a user to sign into Chrome to potentially exploit heap corruption via a crafted HTML page...

CVE-2021-37997: Use After Free

Use after free in Sign-In in Google Chrome prior to 95.0.4638.69 allowed a remote attacker who convinced a user to sign into Chrome to potentially exploit heap corruption via a crafted HTML page...

The vulnerability of the Sign-In component in Google Chrome and Microsoft Edge browsers allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the Sign-In component in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failure through a specially created web page...

Remote Code Execution (RCE)

chrome is vulnerable to remote code execution. The vulnerability exists due to a security issue found in the Sign-In component of the Chromium browser...

Chromium: CVE-2021-37997 Use after free in Sign-In

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Google Chrome Post-release Reuse Vulnerability (CNVD-2021-99264)

Chrome is a simple and efficient web browsing tool developed by Google. A post-release reuse vulnerability exists in Sign-In in versions prior to Google Chrome 95.0.4638.69. An attacker could exploit this vulnerability to cause heap corruption via a crafted HTML page latently...

Google Chrome 资源管理错误漏洞

Chrome is a simple and efficient web browsing tool developed by Google. A post-release reuse vulnerability exists in Sign-In in versions prior to Google Chrome 95.0.4638.69. An attacker could exploit this vulnerability to cause heap corruption via a crafted HTML page latently...

Google Chrome < 95.0.4638.69 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 95.0.4638.69. It is, therefore, affected by multiple vulnerabilities as referenced in the 202110stable-channel-update-for-desktop28 advisory. - Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69...

CVE-2021-43409

The “WPO365 | LOGIN” WordPress plugin up to and including version 15.3 by wpo365.com is vulnerable to a persistent Cross-Site Scripting XSS vulnerability also known as Stored or Second-Order XSS. Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data...

The vulnerability of the Sign-In component in Google Chrome and Microsoft Edge browsers allows a hacker to execute arbitrary code.

The vulnerability of the Sign-In component in Google Chrome and Microsoft Edge browsers relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code through a specially created web page...

openSUSE 15 Security Update : opera (openSUSE-SU-2021:1310-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1310-1 advisory. - Chromium: CVE-2021-30606 Use after free in Blink CVE-2021-30606 - Chromium: CVE-2021-30607 Use after free in Permissions CVE-2021-30607 -...

openSUSE 15 Security Update : chromium (openSUSE-SU-2021:1303-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1303-1 advisory. - Chromium: CVE-2021-30606 Use after free in Blink CVE-2021-30606 - Chromium: CVE-2021-30607 Use after free in Permissions CVE-2021-30607 -...

openSUSE 15 Security Update : chromium (openSUSE-SU-2021:1300-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1300-1 advisory. - Chromium: CVE-2021-30606 Use after free in Blink CVE-2021-30606 - Chromium: CVE-2021-30607 Use after free in Permissions CVE-2021-30607 -...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2021:1303-1 Rating: important References: 1190096 1190476 Cross-References: CVE-2021-30606 CVE-2021-30607 CVE-2021-30608 CVE-2021-30609 CVE-2021-30610 CVE-2021-30611 CVE-2021-30612 CVE-2021-30613 CVE-2021-30614...

Catching the big fish: Analyzing a large-scale phishing-as-a-service operation

In researching phishing attacks, we came across a campaign that used a rather high volume of newly created and unique subdomains—over 300,000 in a single run. This investigation led us down a rabbit hole as we unearthed one of the operations that enabled the campaign: a large-scale...

You Can Now Sign-in to Your Microsoft Accounts Without a Password

Microsoft on Wednesday announced a new passwordless mechanism that allows users to access their accounts without a password by using Microsoft Authenticator, Windows Hello, a security key, or a verification code sent via SMS or email. The change is expected to be rolled out in the coming weeks...

User Profile Error - The volume is too fragmented to complete this transaction in Applayer Image

"User Profile Service service failed the sign-in. User profile cannot be loaded". Error :The volume is too fragmented to complete this transaction...

A week in security (August 30 – September 5)

Last week on Malwarebytes Labs ProxyToken: another nail-biter from Microsoft Exchange Macs turn on apps signed by Symantec, treat them as malware Google Play sign-ins can be abused to track another person’s movements FTC bans SpyFone and its CEO from continuing to sell stalkerware BrakTooth...