409 matches found
the-callback-that-outlived-the-page-cve-2026-78997-uc-browser-android-universal-xss
CVE-2026-78997 — UC Browser para Android Universal XSS UXSS Material PoC para CVE-2026-78997 — Universal Cross-Site Scripting en UC Browser para Android com.UCMobile.intl, versión 13.7.8.1314, divulgado por Omri Inbar Novee. Un XSS reflejado en el dominio incluido en la lista blanca del puente...
RP_DCP_Code_Exec
Vulnerabilidad de ejecución remota de código arbitrario en el URI 'DCP://' de Real Player Vídeo demo: https://youtu.be/AMODp3iTnqY El esquema de URI 'DCP://' es un protocolo interno utilizado por Real Player para recuperar URL que mostrar en la pestaña del navegador del reproductor. Significa 'Da...
CVE-2017-7089
CVE-2017-7089 Impact : Processing maliciously crafted web content may lead to universal cross site scripting Description : A logic issue existed in the handling of the parent-tab. This issue was addressed with improved state management. Safari 10 Local SOP bypass function Pewvar...
CVE-2017-5124
CVE-2017-5124 UXSS con MHTML DEMO: https://bo0om.ru/chromepoc/PoC.php probado en Chrome/61.0.3163.100...
CVE-2021-43530-UXSS-On-QRcode-Reader-
CVE-2021-43530-UXSS-On-QRcode-Reader- CVE-2021-43530 Una vulnerabilidad de XSS universal estaba presente en Firefox para Android, resultante de una sanitización incorrecta al procesar una URL escaneada desde un código QR. Este bug solo afecta a Firefox para Android. Otros sistemas operativos no s...
CVE-2026-86898
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting...
DEBIAN-CVE-2026-86898
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting...
CVE-2026-86898
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting...
CVE-2026-86898
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting...
EUVD-2026-77932
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting...
CVE-2026-86898
A logic issue exists in the WebKit component of Safari 27 , iOS 27 , iPadOS 27 , macOS Golden Gate 27 , and visionOS 27 . The root cause is a flaw in state management that can be triggered by opening a maliciously crafted webarchive file . This vulnerability may lead to universal cross-site scrip...
PT-2026-91698
Name of the Vulnerable Software and Affected Versions Safari versions prior to 27 iOS versions prior to 27 iPadOS versions prior to 27 macOS Golden Gate versions prior to 27 visionOS versions prior to 27 Description A logic issue involving state management allows for universal cross-site scriptin...
CVE-2026-78997
UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...
EUVD-2026-72670
NuBrowser lacks protocol whitelist validation for the S.browserfallbackurl field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting UXSS vulnerability that enables script execution within the origin of arbitrary websites...
CVE-2026-78997
UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...
CVE-2026-78997
UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...
CVE-2026-78997
UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314 ) is vulnerable to a Universal Cross-Site Scripting (UXSS) flaw. The issue stems from a reflected XSS on the bridge-whitelisted domain mtmsg.uc.cn, which allows attackers to access the privileged ucapi JavaScript bridge. Speci...
EUVD-2026-72957
UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...
PT-2026-87176
UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...