535 matches found
CVE-2017-15430
CVE-2017-15430 affects the Chromecast plugin in Google Chrome prior to 63.0.3239.84. Root cause: insufficient data validation in the Chromecast plugin. Impact: remote attacker could inject arbitrary scripts/HTML (UXSS) via a crafted HTML page. Public references note the vulnerability in Chrome’s ...
CVE-2017-15430
Insufficient data validation in Chromecast plugin in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page...
CVE-2017-15429: Improper Neutralization of Input During Web Page Generation
Inappropriate implementation in V8 WebAssembly JS bindings in Google Chrome prior to 63.0.3239.108 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page...
CVE-2017-15430: Undefined Security Weakness
Insufficient data validation in Chromecast plugin in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page...
Google Chrome < 67.0.3396.62 Multiple Vulnerabilities
Binary data 700358.pasl...
Facebook BB #71 - (API) UXSS via MS Internet Explorer 11
Document Title: =============== Facebook BB 71 - API UXSS via MS Internet Explorer 11 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1915 Video: https://www.youtube.com/watch?v=8QFymo42JI Release Date: ============= 2018-08-09 Vulnerability Laboratory ID VL-ID:...
Facebook BB #71 - (API) UXSS via MS Internet Explorer 11
Document Title: =============== Facebook BB 71 - API UXSS via MS Internet Explorer 11 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1915 Video: https://www.youtube.com/watch?v=8QFymo42JI Release Date: ============= 2018-08-08 Vulnerability Laboratory ID VL-ID:...
KLA11732 Multiple vulnerabilities in Opera
Multiple vulnerabilities were found in Opera. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, bypass security restrictions, perform cross-site scripting attack, spoof user interface, execute arbitrary code. Below is a complete list of...
Steam, Fire, and Paste – A Story of UXSS via DOM-XSS & Clickjacking in Steam Inventory Helper
Summary The “Steam Inventory Helper” Chrome extension version 1.13.6 suffered from both a DOM-based Cross-site Scripting XSS and a clickjacking vulnerability. By combining these vulnerabilities it is possible to gain JavaScript code execution in the highly-privileged context of the extension's...
Google Chrome Security Updates (stable-channel-update-for-desktop_29-2018-05) - Windows
Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...
chromium -- multiple vulnerabilities
Google Chrome Releases reports: 34 security fixes in this release, including: 835639 High CVE-2018-6123: Use after free in Blink. Reported by Looben Yang on 2018-04-22 840320 High CVE-2018-6124: Type confusion in Blink. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-07 818592 High...
Tor: Tor Browser: iframe with `data:` uri has access to parent window
Version: 7.5.4 based on Mozilla Firefox 52.8.0 Tested with standard security slider. However, it's likely to be possible with a higher security level. Summary In Tor Browser iframe with data:uri inherits the origin of parent window. That leads to iframe has access to parent window. PoC Iframe cou...
CVE-2018-10000
CVE-2018-10000 describes a universal XSS (UXSS) in the Video Downloader professional extension for Chrome, prior to 2018-04-05. The issue arises via vectors related to a link64_msgAddLinks event, allowing an attacker to trigger cross-site scripting within the extension context. The NVD entry list...
CVE-2018-10000: Improper Neutralization of Input During Web Page Generation
The Video Downloader professional extension before 2018-04-05 for Chrome has Universal XSS UXSS via vectors related to a link64msgAddLinks event...
CVE-2017-2492
CVE-2017-2492 is an UXSS vulnerability in Apple’s JavaScriptCore affecting iOS <10.3, Safari <10.1, and tvOS
CVE-2017-5124
Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted MHTML page...
Design/Logic Flaw
Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted MHTML page...
CVE-2017-5124
Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted MHTML page...
CVE-2017-5124
CVE-2017-5124 is a cross-site scripting (UXSS) vulnerability in the MHTML handling of Chromium/Blink, allowing a remote attacker to inject scripts/HTML via a crafted MHTML page in Google Chrome prior to 62.0.3202.62. Affected software: Google Chrome/Chromium (Blink). Impact: arbitrary script exec...
