2102 matches found
Cross Site Scripting(XSS)
OpenC3 COSMOS is vulnerable to Cross Site ScriptingXSS. The vulnerability is due to the insecure storage of user passwords in an unencrypted format within the LocalStorage of a web browser, allows an attacker to execute malicious scripts in a user's browser...
MGASA-2024-0321 Updated chromium-browser-stable packages fix security vulnerabilities
Use after free in Downloads. CVE-2024-6988 Use after free in Loader. CVE-2024-6989 Use after free in Dawn. CVE-2024-6991 Heap buffer overflow in Layout. CVE-2024-6994 Inappropriate implementation in Fullscreen. CVE-2024-6995 Race in Frames. CVE-2024-6996 Use after free in Tabs. CVE-2024-6997 Use...
CVE-2023-7282
Inappropriate implementation in Navigation in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. Chromium security severity: Low...
Wire UI has a JS XSS Vulnerability on route /wireui/button?label=Content
Summary A potential Cross-Site Scripting XSS vulnerability has been identified in the /wireui/button endpoint, specifically through the label query parameter. Malicious actors could exploit this vulnerability by injecting JavaScript into the label parameter, leading to the execution of arbitrary...
mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran
The Mozilla Foundation's Security Advisory: Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence...
RHSA-2019:1553 Red Hat Security Advisory: chromium-browser security update
Bulletin has no description...
RHSA-2018:1446 Red Hat Security Advisory: chromium-browser security update
Bulletin has no description...
RHSA-2016:1485 Red Hat Security Advisory: chromium-browser security update
Bulletin has no description...
RHSA-2015:1499 Red Hat Security Advisory: chromium-browser security update
Bulletin has no description...
Ubuntu 22.04 LTS / 24.04 LTS : WebKitGTK vulnerabilities (USN-6996-1)
The remote Ubuntu 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6996-1 advisory. Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website,...
The New Effective Way to Prevent Account Takeovers
Account takeover attacks have emerged as one of the most persistent and damaging threats to cloud-based SaaS environments. Yet despite significant investments in traditional security measures, many organizations continue to struggle with preventing these attacks. A new report, "Why Account Takeov...
HTTP Client Automatic Exploiter 2 (Browser Autopwn)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "HTTP Client Automatic Exploiter 2 Browser Autopwn", 'Description' = %q This module will automatically serve browser exploits. Here are the option...
CVE-2024-34577
Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, WRC-X3000GS2A-B and WRC-X3000GST2-B due to improper processing of input values in easysetup.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web...
CVE-2024-41842
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page...
Cross Site Scripting (XSS)
bootstrap is vulnerable to Cross Site Scripting XSS. The vulnerability is caused due to a missing sanitization in the href attribute of the tag while working with data-slide and data-slide-to attributes. This could enable an attacker to execute arbitrary JavaScript within the victim's browser...
mozilla: Fullscreen notification dialog can be obscured by document content
The Mozilla Foundation Security Advisory describes this flaw as: Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack...
Microsoft Edge (HTML-based) Memory Corruption Vulnerability (CNVD-2024-39661)
Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. A memory corruption vulnerability exists in Microsoft Edge HTML-based, which can be exploited by an attacker to execute arbitrary code on a system...
Webinar: Securing the Modern Workspace: What Enterprises MUST Know about Enterprise Browser Security
The browser is the nerve center of the modern workspace. Ironically, however, the browser is also one of the least protected threat surfaces of the modern enterprise. Traditional security tools provide little protection against browser-based threats, leaving organizations exposed. Modern...
How to Cut Costs with a Browser Security Platform
Browser security is becoming increasingly popular, as organizations understand the need to protect at the point of risk - the browser. Network and endpoint solutions are limited in their ability to protect from web-borne threats like phishing websites or malicious browser extensions. They also do...