Phoenix Arbitrary URL Redirect

The Phoenix team designed Phoenix.Controller.redirect/2 to protect against redirects allowing user input to redirect to an external URL where your application code otherwise assumes a local path redirect. This is why the :to option is used for “local” URL redirects and why you must pass the...

Microsoft Edge browser’s vulnerability, related to improper code generation management, allows attackers to escalate their privileges.

The vulnerability of Microsoft Edge is related to incorrect code generation management. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

Microsoft Edge browser’s vulnerability, related to improper code generation management, allows attackers to escalate their privileges.

The vulnerability of Microsoft Edge is related to improper handling of code generation. Exploiting this vulnerability allows a malicious actor to enhance their privileges through a specially created web page...

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to execute arbitrary code.

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine exists due to a mix of data types. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, Inc. and V8 is an open source JavaScript engine. A security vulnerability exists in Google Chrome V8 prior to version 100.0.4896.75, which stems from a type confusion issue. A remote attacker can exploit this vulnerability to potentially cause heap...

Design/Logic Flaw

A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website attached with USSD code in JavaScript or iFrame can trigger dialer application from F-Secure browser which can be exploited by an attacker to send unwanted USSD messages or perform unwanted calls. In mos...

F-secure F-Secure SAFE 安全漏洞

F-secure F-Secure SAFE is a suite of antivirus software from the Finnish company F-Secure F-secure. A security vulnerability exists in the F-Secure SAFE browser, which originates from a maliciously crafted website with USSD code in JavaScript or an iFrame that can trigger a dial-up application fr...

Apple watchOS 安全漏洞

Apple watchOS is an operating system for smartwatches from Apple Inc. in the United States. Apple watchOS 8.5 previously contained a security vulnerability that originated in Apple's browser that could lead to address bar spoofing when visiting a malicious website...

Cross site scripting

A vulnerability affecting F-Secure SAFE browser was discovered whereby browsers loads images automatically this vulnerability can be exploited remotely by an attacker to execute the JavaScript can be used to trigger universal cross-site scripting through the browser. User interaction is required...

F-secure F-Secure SAFE 跨站脚本漏洞

F-Secure F-Secure SAFE is a suite of antivirus software from the Finnish company F-Secure F-secure.F-Secure SAFE Browser for Android is vulnerable to cross-site scripting, which can be exploited by attackers to remotely execute JavaScript and trigger generic cross-site scripting through the brows...

CVE-2022-23710

A cross-site-scripting XSS vulnerability was discovered in the Data Preview Pane previously known as Index Pattern Preview Pane which could allow arbitrary JavaScript to be executed in a victim’s browser...

Naver Whale browser 安全漏洞

Naver Whale Browser is a web browser from the Korean company Naver that supports user-defined interfaces. A security vulnerability previously existed in Naver Whale browser 3.12.129.46 that allowed an attacker to corrupt the rendering process, which could lead to taking control of the browser's...

Cross-site Scripting (XSS) - Stored in vanessa219/vditor

Description The Vanessa219/vditor is a markdown editor supported by browsers. When a user creates a link using the markdown syntax, the server does not URL-encode the double-quotes, so the user can escape the href attribute and trigger XSS using the on attribute. Proof of Concept txt XSS PoC : xs...

Policy Bypass

chromium-browser is vulnerable to policy bypass. The vulnerability exists in service workers which allows an attacker to bypass policy...

PT-2022-1722 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge Chromium-based versions affected versions not specified Description: The issue is related to privilege management errors in the browser, which can allow an attacker to execute arbitrary code. Recommendations: At the moment, the...

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to bypass existing security restrictions.

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine arises from the simultaneous execution using a shared resource with incorrect synchronization in the “Race Situation” mode. Exploiting this vulnerability allows an attacker to bypass existing security restrictions...

Mozilla: Bypass of CSP sandbox directive when embedding

Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

CVE-2021-33593

Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may lead to address bar spoofing...

Apple Patches Critical iOS Bugs; One Under Attack

Apple lovers who haven’t yet updated to iOS 15, you may want to pop into Settings to freshen up your iPhone now: Apple has released several critical security updates that might light a fire under your britches. On Monday and Tuesday, Apple released iOS 14.8.1, iPadOS 14.8.1, watchOS 8.1 and tvOS...

The vulnerability of the Mozilla Firefox browser, related to errors in processing HTML content, allows a hacker to execute arbitrary code within the system.

The vulnerability of the Mozilla Firefox browser is related to errors in processing HTML content. Exploiting this vulnerability allows a remote attacker to execute arbitrary code within the system...