CVE-2018-6108

CVE-2018-6108 affects Google Chrome/Chromium URL Formatter, where incorrect handling of confusable characters (IDN homographs) could enable domain spoofing via a crafted HTML page. Affected product: Google Chrome (and Chromium) prior to Chrome 66.0.3359.117. Root cause: misprocessing of internati...

CVE-2018-6104

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name...

CVE-2018-6098

CVE-2018-6098 refers to a URL spoofing vulnerability in Google Chrome's URL Formatter caused by incorrect handling of confusable characters in IDN homographs. The issue affects Chrome prior to 66.0.3359.117, enabling a remote attacker to perform domain spoofing via a crafted domain name. The publ...

CVE-2018-6108

Removed by vendor...

CVE-2018-6104

Removed by vendor...

CVE-2018-6098

Removed by vendor...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 43 security fixes in this release, including: High CVE-2018-17480: Out of bounds write in V8 High CVE-2018-17481: Use after free in PDFium High CVE-2018-18335: Heap buffer overflow in Skia High CVE-2018-18336: Use after free in PDFium High CVE-2018-18337: Use after...

kibana: Cross-site scripting via the source field formatter

Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting XSS vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users...

Gitlab -- multiple vulnerabilities

Gitlab reports: SSRF GCP access token disclosure Persistent XSS on issue details Diff formatter DoS in Sidekiq jobs Confidential information disclosure in events API endpoint validatelocalhost function in urlblocker.rb could be bypassed Slack integration CSRF Oauth2 GRPC::Unknown logging token...

CVE-2018-3830

Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting XSS vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users...

CVE-2018-3830

Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting XSS vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users...

CVE-2018-3830

Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting XSS vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users...

CVE-2018-3830

Kibana CVE-2018-3830 is a cross-site scripting (XSS) vulnerability in the source field formatter affecting Kibana versions 5.3.0 through 6.4.1. The issue allows an attacker to obtain sensitive information from or perform actions on behalf of other Kibana users. Remediation provided by the linked ...

Elastic Stack 6.4.1 and 5.6.12 security update

Kibana XSS issue ESA-2018-14 Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting XSS vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. Affected Versions Versions afte...

PT-2018-16224 · Elastic · Kibana

Name of the Vulnerable Software and Affected Versions: Kibana versions 5.3.0 through 6.4.1 Description: A cross-site scripting XSS issue was found in the source field formatter, allowing an attacker to obtain sensitive information or perform actions on behalf of other users. Recommendations: For...

GHSA-GXPJ-CX7G-858C Regular Expression Denial of Service in debug

Affected versions of debug are vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue. This was later re-introduced in version v3.2.0, and...

chromium-browser: URL spoof in Omnibox

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name...

CVE-2018-6175

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name...

CVE-2018-6173

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name...

CVE-2018-6172

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name...