Vanilla: XSS through chat messages

vulnerability name: cross site scripting through chat messages vulnerability description: cross site scripting is a vulnerability that allows an attacker to send malicious codeusually in javascript form to another user Because a browser cannot know if the script should be trusted or not, it will...

chromium-browser: Insufficient checks on filesystem: URI permissions

Insufficient policy enforcement in storage in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page...

Google Chrome Security Bypass Vulnerability (CNVD-2019-26517)

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in versions of Google Chrome prior to 76.0.3809.87. An attacker can exploit this vulnerability by tricking a user into visiting a specially crafted website to bypass security restrictions and gain...

CVE-2019-11702

A hyperlink using protocols associated with Internet Explorer, such as IE.HTTP:, can be used to open local files at a known location with Internet Explorer if a user approves execution when prompted. Note: this issue only occurs on Windows. Other operating systems are unaffected.. This...

CVE-2019-1104

A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corruption Vulnerability'...

Kartpay: Application Error disclosure, Verification token seen error and user able to change password

Summary: Application Error disclosure, Verification token seen error and user able to change password Browsers Verified In: Broswer version: Google Chrome is up to date Version 75.0.3770.100 Official Build 64-bit Steps To Reproduce: add details for how we can reproduce the issue Steps to reproduc...

The vulnerability of Microsoft Edge’s JavaScript script handler allows a hacker to execute arbitrary code.

The vulnerability of Microsoft Edge’s JavaScript script handler is related to errors in memory object handling. Exploiting this vulnerability allows a malicious actor to execute arbitrary code via a specially crafted web page...

Design/Logic Flaw

An issue was discovered in Open Ticket Request System OTRS 7.0.x through 7.0.7, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36. An attacker could send a malicious email to an OTRS system. If a logged-in agent user quotes it, the email could cause the browser to...

Microsoft Edge Buffer Overflow Vulnerability (CNVD-2019-27395)

Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. A buffer overflow vulnerability exists in the way the Chakra scripting engine handles memory objects in Microsoft Edge. An attacker could exploit this vulnerability to execute arbitrary...

Design/Logic Flaw

Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection. In other words, a third-party application can read the user's cleartext browser history via an app.provider.query...

Mozilla: Stealing of cross-domain images using canvas

Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird 60.7, Firefox 67, and Firefox ESR 60.7...

The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser allows a hacker to execute arbitrary code.

The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser is related to errors in memory object handling. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser, related to errors in memory object handling, allows a hacker to execute arbitrary code.

The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser is related to errors in processing objects in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user...

CVE-2019-12383

Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to detect the browser's UI locale by measuring a button width, even if the user has a "Don't send my language" setting...

CVE-2019-0918

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0884, CVE-2019-0911...

PT-2021-2516 · Tor +4 · Tor +4

Name of the Vulnerable Software and Affected Versions: Tor versions prior to 0.4.5.7 Description: The issue allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target. This is related to an error in the resource consumption control mechanism of the Tor browser'...

CVE-2018-4065

An exploitable cross-site scripting vulnerability exists in the ACEManager pingresult.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP ping request can cause reflected javascript code execution, resulting in the execution of javascript code running on the...

UBUNTU-CVE-2018-8035

This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC = 2.2.2 which runs in the user's browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user supplied javascript code...

CVE-2019-9806

A vulnerability exists during authorization prompting for FTP transaction where successive modal prompts are displayed and cannot be immediately dismissed. This allows for a denial of service DOS attack. This vulnerability affects Firefox 66...

Google Chrome Blink Buffer Overflow Vulnerability (CNVD-2019-13775)

Google Chrome is a Web browser from Google, a U.S. company. Blink is a browser layout engine rendering engine jointly developed by Google and Norway's OperaSoftware. A heap buffer overflow vulnerability exists in Blink in versions prior to Google Chrome 74.0.3729.108, which can be exploited by an...