DEBIAN-CVE-2023-5996

Use after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

golang: html/template: improper handling of empty HTML attributes

A flaw was found in golang. Templates containing actions in unquoted HTML attributes, for example, "attr=." executed with empty input, could result in output that has unexpected results when parsed due to HTML normalization rules. This issue may allow the injection of arbitrary attributes into ta...

The vulnerability of the Django web application framework, related to the inefficient complexity of regular expressions, allows attackers to trigger a service failure.

The vulnerability of the Django web application framework relates to regular expressions for text trimming, which have linear complexity in their reverse path computation, potentially leading to slow performance. Exploiting this vulnerability could allow a remote attacker to cause service...

LiquidFiles Security Vulnerability

Liquidfiles is a storage service for large-scale secure file transfer and sharing for companies and organizations from US-based Liquidfiles, Inc. A security vulnerability exists in LiquidFiles version 3.7.13 and prior versions that stems from the presence of HTML and SMTP injection issues...

python-django: Denial-of-service possibility in django.utils.text.Truncator

An inefficient regular expression complexity was found in Django. The text truncator regular expressions exhibit linear backtracking complexity, which can be slow, leading to a potential denial of service, given certain HTML inputs...

USN-6414-1 python-django vulnerability

Wenchao Li discovered that the Django Truncator function incorrectly handled very long HTML input. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service...

libvpx: Heap buffer overflow in vp8 encoding in libvpx

A heap-based buffer overflow flaw was found in the way libvpx, a library used to process VP8 and VP9 video codecs data, processes certain specially formatted video data via a crafted HTML page. This flaw allows an attacker to crash or remotely execute arbitrary code in an application, such as a w...

The vulnerability of Google Chrome’s user tabs allows a hacker to bypass existing security restrictions.

The vulnerability of user tabs in Google Chrome is related to the improper use of standard permissions. Exploiting this vulnerability allows a malicious actor to bypass security restrictions through a specially created HTML page...

DEBIAN-CVE-2023-4909

Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML page. Chromium security severity: Low...

PT-2023-5489 · Google +1 · Google Chrome +1

Name of the Vulnerable Software and Affected Versions: Google Chrome on Android versions prior to 117.0.5938.62 Description: The issue is related to an inappropriate implementation in Intents, allowing a remote attacker to obfuscate security UI via a crafted HTML page. This could potentially enab...

The vulnerability of the Google Chrome XML browser component allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Google Chrome XML browser component is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through a specially created HTML page...

SUSE CVE-2023-4364

Inappropriate implementation in Permission Prompts in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. Chromium security severity: Medium...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in versions of Google Chrome prior to 116.0.5845.96, which stems from a mix-up of instructions responsible for freeing memory in Extensions. A remote attacker can exploit this vulnerability...

The vulnerability of Google Chrome’s user interface allows a perpetrator to read and write arbitrary files.

The vulnerability of Google Chrome’s user interface is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to read and write arbitrary files using a specially crafted HTML page...

golang: html/template: improper handling of JavaScript whitespace

A flaw was found in golang, where not all valid JavaScript white-space characters were considered white space. Due to this issue, templates containing white-space characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be...

AZL-43555 CVE-2023-3978 affecting package podman 4.1.1-26

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...

DEBIAN-CVE-2022-4912

Type Confusion in MathML in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

The vulnerability of the DevTools set of tools for web development in the Google Chrome web browser allows a hacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the DevTools suite for web development in the Google Chrome web browser relates to the use of memory after it is released. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause a service failure through the u...

The vulnerability of the Mojo browser’s IPC library in Google Chrome allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the Mojo library in Google Chrome browsers relates to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure or execute arbitrary code using a specially created HTML page...

JStachio 跨站脚本漏洞

JStachio is a type-safe Java Mustache template engine. A security vulnerability exists in JStachio versions prior to 1.0.1, which stems from JStachio's inability to escape single quotes in HTML, and can be exploited by an attacker to inject malicious code...