Evernote Web Clipper Same-Origin Policy Bypass Vulnerability

Evernote Web Clipper suffered from a same-origin policy bypass vulnerability. The link to the demo exploit was a 403 at the time of addition and has not been included in this post. Evernote: extension allows cross-origin iframe communication I happened to notice that the Evernote Web Clipper...

Evernote Web Clipper Cross-Site Scripting (CVE-2019-12592)

A cross-site scripting vulnerability exists in Evernote Web Clipper Extension. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary commands on the affected system...

CVE-2019-12592

A universal Cross-site scripting UXSS vulnerability in the Evernote Web Clipper extension before 7.11.1 for Chrome allows remote attackers to run arbitrary web script or HTML in the context of any loaded 3rd-party IFrame...

CVE-2019-12592

A universal Cross-site scripting UXSS vulnerability in the Evernote Web Clipper extension before 7.11.1 for Chrome allows remote attackers to run arbitrary web script or HTML in the context of any loaded 3rd-party IFrame...

Cross site scripting

A universal Cross-site scripting UXSS vulnerability in the Evernote Web Clipper extension before 7.11.1 for Chrome allows remote attackers to run arbitrary web script or HTML in the context of any loaded 3rd-party IFrame...

CVE-2019-12592

CVE-2019-12592 affects the Evernote Web Clipper Chrome extension (pre-7.11.1). The vulnerability arises from a mis-handled URL construction in the extension’s iframe/injection framework, allowing a remote site to inject scripts via postMessage and inject a payload into all frames, effectively cau...

CVE-2019-12592

A universal Cross-site scripting UXSS vulnerability in the Evernote Web Clipper extension before 7.11.1 for Chrome allows remote attackers to run arbitrary web script or HTML in the context of any loaded 3rd-party IFrame...