CVE-2021-21147

CVE-2021-21147 affects Chromium/Chrome where Skia had an inappropriate implementation that could allow a local attacker to spoof the Omnibox (URL bar) via a crafted HTML page. The public records consistently cite version 88.0.4324.146 as the fix, with Debian notes stating the patch is in 88.0.432...

CVE-2021-26722

LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar...

CVE-2021-26722

LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar...

PYSEC-2021-33

LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar...

CVE-2021-26722

LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar...

Cross site scripting

LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar...

PYSEC-2021-33

LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar...

Google Chromium 安全漏洞

Chrome is a simple and efficiently designed web browsing tool developed by Google. A Skia improperly implemented vulnerability exists in versions of Google Chrome prior to 88.0.4324.146. An attacker can exploit this vulnerability to spoof the contents of the multifunction box URL bar via a crafte...

Google Chrome Skia Improperly Implemented Vulnerability

Chrome is a simple and efficiently designed web browsing tool developed by Google. A Skia improperly implemented vulnerability exists in versions of Google Chrome prior to 88.0.4324.146. An attacker can exploit this vulnerability to spoof the contents of the multifunction box URL bar via a crafte...

Security update for opera (moderate)

openSUSE Security Update: Security update for opera Announcement ID: openSUSE-SU-2021:0138-1 Rating: moderate References: Cross-References: CVE-2020-15995 CVE-2020-16043 CVE-2021-21106 CVE-2021-21107 CVE-2021-21108 CVE-2021-21109 CVE-2021-21110 CVE-2021-21111 CVE-2021-21112 CVE-2021-21113...

LY Corporation: Webview address bar spoofing in LINE client for iOS

When navigation to an invalid hostname occurs, the address bar is updated even though the navigation is cancelled. Due to this incorrect timing of updating the address bar and applying URL normalization, it can be recognized as a different hostname from the actual hostname. As a result, attacker...

The vulnerability of the Mozilla Firefox browser, related to ignoring leading JavaScript symbols in the address line, allows attackers to perform cross-site scripting attacks.

The vulnerability of the Mozilla Firefox browser is related to the ignoring of leading JavaScript symbols in the address line. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

The vulnerability of the Mozilla Firefox browser, related to the lack of a mechanism for checking the input data in the address bar, allows attackers to perform spear-phishing attacks.

The vulnerability of the Mozilla Firefox browser is related to the lack of a mechanism for checking the input data in the address bar. Exploiting this vulnerability allows an attacker to perform spear-phishing attacks remotely...

EulerOS 2.0 SP3 : webkitgtk3 (EulerOS-SA-2021-1130)

According to the version of the webkitgtk3 package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could...

Huawei EulerOS: Security Advisory for webkitgtk3 (EulerOS-SA-2021-1130)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross-Site Scripting (XSS)

Jenkins is vulnerable to cross-site scripting . An attacker is able to inject and execute arbitrary Javascript in a user's browser via notification bar response content due to lack of output sanitization...

Cloudbees Jenkins Cross-Site Scripting Vulnerability (CNVD-2021-03556)

Cloudbees Jenkins Hudson Labs is the United States CloudBees Cloudbees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . Jenkins version 2.274 and before...

Cross site scripting

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents, resulting in a cross-site scripting XSS vulnerability...

CVE-2021-21603

CVE-2021-21603 affects Jenkins 2.274 and earlier (including LTS 2.263.1) where notification bar response contents are not escaped, enabling cross-site scripting (XSS). Multiple connected advisories confirm this vulnerability and note remediation: Jenkins 2.275 (and LTS 2.263.2) fixes by escaping ...

Unspecified Vulnerability in Mozilla Firefox (CNVD-2021-04655)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox for Android prior to version 84. By attempting to connect to a website using a port that fails to respond, an attacker can control the content of tabs...