chromium -- multiple vulnerabilities

Google Chrome Releases reports: 31 vulnerabilities fixed in this release, including: 354123 High CVE-2014-1716: UXSS in V8. Credit to Anonymous. 353004 High CVE-2014-1717: OOB access in V8. Credit to Anonymous. 348332 High CVE-2014-1718: Integer overflow in compositor. Credit to Aaron Staple...

CVE-2014-1701

The CVE-2014-1701 issue affects Blink in Google Chrome prior to 33.0.1750.149. The root cause is a missing cross-origin restriction in GenerateFunction (bindings/scripts/code_generator_v8.pm) for EventTarget::dispatchEvent, enabling Universal XSS via events. Public references in Debian/openSUSE a...

www/chromium --multiple vulnerabilities

Google Chrome Releases reports: 7 vulnerabilities fixed in this release, including: 344881 High CVE-2014-1700: Use-after-free in speech. Credit to Chamal de Silva. 342618 High CVE-2014-1701: UXSS in events. Credit to aidanhs. 333058 High CVE-2014-1702: Use-after-free in web database. Credit to...

Google Chrome < 33.0.1750.149 Multiple Vulnerabilities

The version of Google Chrome installed on the remote host is a version prior to 33.0.1750.149. It is, therefore, affected by the following vulnerabilities : - Use-after-free errors exist related to 'speech' and 'web database' processing. CVE-2014-1700, CVE-2014-1702 - An input validation error...

Design/Logic Flaw

Google Chrome before 21.0.1180.82 on iOS makes certain incorrect calls to WebView methods that trigger use of an applewebdata: URL, which allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS UXSS attacks via vectors involving the document.write method...

CVE-2012-2899

Summary: CVE-2012-2899 affects Google Chrome on iOS prior to 21.0.1180.82. The issue arises from incorrect calls to WebView methods that enable an applewebdata: URL, bypassing the Same Origin Policy and enabling Universal XSS (UXSS) via document.write. Impact: SOP bypass and UXSS risk on affected...

CVE-2012-2899

Removed by vendor...

Apple Safari webarchive File Format UXSS

A UXSS stack vulnerability has been reported in the Apple Safari webarchive File Format...

Mac OS X Safari .webarchive File Format UXSS

Generates a .webarchive file for Mac OS X Safari that will attempt to inject cross-domain Javascript UXSS, silently install a browser extension, collect user information, steal the cookie database, and steal arbitrary local files. When opened on the target machine the webarchive file must not hav...

Chrome for Android - UXSS via com.android.browser.application_id Intent extra

CVE Number: CVE-2012-4905 Title: Chrome for Android - UXSS via com.android.browser.applicationid Intent extra Affected Software: Confirmed on Chrome for Android v18.0.1025123 Credit: Takeshi Terada Issue Status: v18.0.1025308 was released which fixes this vulnerability Overview: By sending a...

Chrome For Android Universal Cross Site Scripting

CVE Number: CVE-2012-4905 Title: Chrome for Android - UXSS via com.android.browser.applicationid Intent extra Affected Software: Confirmed on Chrome for Android v18.0.1025123 Credit: Takeshi Terada Issue Status: v18.0.1025308 was released which fixes this vulnerability Overview: By sending a...

Opera 12.02 Cross Site Scripting

Exploit Title: Opera image/svg+xml UXSS Date: 06.10.2012 Exploit Author: volema.com Author homepage: http://blog.volema.com Vendor Homepage: opera.com Version: Opera 12.02 Tested on: Windows CVE : NO Full disclosure - http://blog.volema.com/opera-svg-xml-shortcut-uxss.html We'll exploit the proce...

Google Releases Chrome 22 and Pays Out Nearly $30K in Rewards

Google has released Chrome 22, a major new version of its browser that includes a huge number of security fixes, many of them high-priority vulnerabilities. The company also handed out nearly $30,000 in rewards to security researchers, more than half of it to Sergey Glazunov, who discovered two...

CVE-2012-2889

Cross-site scripting XSS vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to inject arbitrary web script or HTML via vectors involving frames, aka "Universal XSS UXSS."...

Cross site scripting

Cross-site scripting XSS vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to inject arbitrary web script or HTML via vectors involving frames, aka "Universal XSS UXSS."...

CVE-2012-2889

CVE-2012-2889 is a cross-site scripting (UXSS) vulnerability in WebKit/Chromium that allows a remote attacker to inject script via frame handling in Chrome versions prior to 22.0.1229.79. The CVE is referenced in openSUSE/OpenSUSE security advisories and Safari/Nessus entries, confirming the fram...

CVE-2012-2886

CVE-2012-2886 corresponds to a UXSS (Universal XSS) vulnerability in Chromium/Google Chrome reported as affecting Chrome before 22.0.1229.79, where an attacker could inject arbitrary script via the Google V8 bindings. The connected advisories show that Chromium/OpenSUSE patches were released to a...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 143439 High CVE-2012-2889: UXSS in frame handling. Credit to Sergey Glazunov. 143437 High CVE-2012-2886: UXSS in v8 bindings. Credit to Sergey Glazunov. 139814 High CVE-2012-2881: DOM tree corruption with plug-ins. Credit to Chamal de Silva. 135432 High...

Cross site scripting

Cross-application scripting vulnerability in Google Chrome before 18.0.1025308 on Android allows remote attackers to inject arbitrary web script via unspecified vectors, as demonstrated by "Universal XSS UXSS" attacks against the current tab...

CVE-2012-4905

The CVE-2012-4905 entry describes a UXSS (Universal XSS) flaw in Chrome for Android prior to 18.0.1025308. By sending a crafted Intent with javascript: URIs and by inserting Extra data (com.android.browser.application_id =&gt; com.android.chrome) into an Intent, an attacker could execute arbitrar...