CVE-2019-13711

Insufficient policy enforcement in JavaScript in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2019-13705

Insufficient policy enforcement in extensions in Google Chrome prior to 78.0.3904.70 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension...

CVE-2019-13713

Insufficient policy enforcement in JavaScript in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2019-13697

Insufficient policy enforcement in performance APIs in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2019-13683

Insufficient policy enforcement in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2019-13683

CVE-2019-13683 affects Google Chrome prior to 77.0.3865.75, where insufficient policy enforcement in developer tools could allow a crafted HTML page to leak cross-origin data. The vulnerability is a cross-origin data disclosure via the browser’s developer tools surface, with network-vector exposu...

CVE-2019-13684

Inappropriate implementation in JavaScript in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2019-13697

CVE-2019-13697 is a cross-origin size leak in Google Chrome/Chromium prior to 77.0.3865.120. Connected sources confirm a fix in the 77.0.3865.120 release (and security advisories from Debian, Mageia, Arch Linux) for Chromium/Chrome, addressing the cross-origin information disclosure. Affected com...

CVE-2019-13684

CVE-2019-13684: Chrome prior to 72.0.3626.81 has an inappropriate JavaScript implementation that allows a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Google Chrome (desktop/mobile), version not explicitly stated beyond the pre-72.0.3626.81 range in the pro...

A week in security (November 18 – 24)

Last week on Malwarebytes Labs, we looked at stalkerware’s legal enforcement problem, announced our cooperation with other security vendors and advocacy groups to launch Coalition Against Stalkerware, published our fall 2019 review of exploit kits, looked at how Deepfake on LinkedIn makes for...

CVE-2019-13713: Undefined Security Weakness

Insufficient policy enforcement in JavaScript in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2019-13705: Improper Privilege Management

Insufficient policy enforcement in extensions in Google Chrome prior to 78.0.3904.70 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension...

CVE-2019-13684: Observable Discrepancy

Inappropriate implementation in JavaScript in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2019-13666: Observable Discrepancy

Information leak in storage in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2019-13673: Missing Authorization

Insufficient data validation in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2019-13668: Improper Preservation of Permissions

Insufficient policy enforcement in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2019-5880: Exposure of Sensitive Information to an Unauthorized Actor

Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2019-13711: Undefined Security Weakness

Insufficient policy enforcement in JavaScript in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2019-3428

The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a configuration error vulnerability. An attacker could directly access the management portal in HTTP, resulting in users’ information leakage...

PT-2019-15789

Name of the Vulnerable Software and Affected Versions GoAhead versions prior to 5.0.1 Description The issue arises from the mishandling of redirected HTTP requests that contain a large Host header. Specifically, the GoAhead WebsRedirect utilizes a static host buffer with a limited length, which c...