PT-2018-3272

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 68.0.3440.75 Description The issue is related to errors in security settings in the DevTools component of Google Chrome, allowing an attacker to exploit it by convincing a user to install a malicious extension...

Steam, Fire, and Paste – A Story of UXSS via DOM-XSS & Clickjacking in Steam Inventory Helper

Summary The “Steam Inventory Helper” Chrome extension version 1.13.6 suffered from both a DOM-based Cross-site Scripting XSS and a clickjacking vulnerability. By combining these vulnerabilities it is possible to gain JavaScript code execution in the highly-privileged context of the extension’s...

PT-2017-3203

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 59.0.3071.86 for Mac, Windows, and Linux Google Chrome version prior to 59.0.3071.92 for Android Description The issue is related to an inappropriate implementation in Blink, allowing a remote attacker to displa...

PT-2017-3236

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 58.0.3029.81 Opera versions prior to 58.0.3029.81 Description The issue exists due to an insufficient watchdog timer in navigation, allowing a remote attacker to spoof the contents of the Omnibox URL bar via a...

Drupal Prepopulate Module Security Bypass Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community. prepopulate is one of the prepopulated field modules. Drupal Prepopulate has a security vulnerability due to a failure to restrict users from overriding any portion of $REQUEST and...