CVE-2022-1146: Observable Discrepancy

Inappropriate implementation in Resource Timing in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key which is capable of breaking CORS policy and allowing any page to make requests, and retrieve data on behalf of other users. Remediation Upgrade github.com/emicklei/go-restful to version...

Mozilla: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-origin information

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue as an attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key handles. This could have...

Mozilla: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-origin information

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue as an attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key handles. This could have...

Mozilla: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-origin information

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue as an attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key handles. This could have...

Remote Code Execution

chromium is vulnerable to remote code execution. The vulnerability exists due to Inappropriate implementation in PDF which allows an attacker to leak cross-origin data via a malicious HTML page...

Privilege Escalation

chromium is vulnerable to privilege escalation. The vulnerability exists through the coop component allowing a remote attacker to leak cross-origin data via a crafted HTML page...

PT-2022-3148

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 102.0.5005.61 Description The issue is related to insufficient policy enforcement in the COOP component of Google Chrome, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This can be...

PT-2022-3150

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 102.0.5005.61 Microsoft Edge affected versions not specified Description The issue is related to an inappropriate implementation in PDF handling, allowing a remote attacker to leak cross-origin data via a crafte...

CVE-2021-21135

Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2021-38009

Inappropriate implementation in cache in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2021-21173

Side-channel information leakage in Network Internals in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Remote Code Execution

chromium is vulnerable to remote code execution. Inappropriate implementation in Web Contents in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Microsoft Edge (Chromium) < 101.0.1210.47 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 101.0.1210.47. It is, therefore, affected by multiple vulnerabilities as referenced in the May 13, 2022 advisory. - Use after free in Sharing in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who...

webkit2gtk3 security, bug fix, and enhancement update

An update is available for webkit2gtk3. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list WebKitGTK is the port of the portable web rendering engine WebKit to the...

PT-2022-2482

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 101.0.4951.64 Description The issue is caused by an inappropriate implementation in Web Contents, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This is due to insufficient input...

PT-2022-2413

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 101.0.4951.41 Description The issue is related to an inappropriate implementation in iframe, which may allow a remote attacker to leak cross-origin data via a crafted HTML page. This could potentially disclose...

PT-2022-2400

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 101.0.4951.41 Microsoft Edge affected versions not specified Description The issue is related to an inappropriate implementation in the Extensions API, allowing an attacker to leak cross-origin data via a crafte...

PT-2022-2409

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 101.0.4951.41 Microsoft Edge affected versions not specified Description The issue is related to an inappropriate implementation in the HTML parser, which can allow a remote attacker to leak cross-origin data...

CVE-2022-0806

Data leak in Canvas in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in screen sharing to potentially leak cross-origin data via a crafted HTML page...