chromium -- cross-site scripting vulnerability

Google Chrome Releases reports: 117226 117230 Critical CVE-2011-3046: UXSS and bad history navigation. Credit to Sergey Glazunov...

CVE-2012-0767

Adobe Flash Player contains a Cross‑Site Scripting (XSS) vulnerability (UXSS) tracked as CVE-2012-0767. The public description specifies that remote attackers could inject arbitrary script or HTML via unspecified vectors. Affected versions include Flash Player before 10.3.183.15 and 11.x before 1...

CVE-2011-3881: Improper Neutralization of Input During Web Page Generation

WebKit, as used in Google Chrome before 15.0.874.102 and Android before 4.4, allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS UXSS attacks via vectors related to 1 the DOMWindow::clear function and use of a selection object, 2 the...

Stable Update: Security Fix

Edit 24 April: Removed "Such an attack only works if Chrome is not already running." Google Chrome's Stable channel has been updated to 1.0.154.59 to fix a security issue: CVE-2009-1412 ChromeHTML protocol handler same-origin bypass An error in handling URLs with a chromehtml: protocol could allo...

Adobe Acrobat Reader Plugin - Multiple Vulnerabilities

Adobe Acrobat Reader Plugin - Multiple Vulnerabilities Original Advisory: http://www.wisec.it/vulns.php?page=9 Original Discovery and Research: Stefano Di Paola Contribution: Giorgio Fedon IE Dos, UXSS Analysis Elia Florio Poc and Code Execution analysis Status: Vendor Informed on 15 October 2006...

CVE-2007-0045: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, for Mozilla Firefox, Microsoft Internet Explorer 6 SP1, Google Chrome, Opera 8.5.4 build 770...

[Full-disclosure] IE UXSS (Universal XSS in IE, was Re: Microsoft Internet Information Services UTF-7 XSS Vulnerability [MS06-053])

Eiji James Yoshida wrote in http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/049784.html : If 'Encoding' is set to 'Auto Select', and Internet Explorer finds a UTF-7 string in the response's body, it will set the charset encoding to UTF-7 automatically ... Proof of concept:...