CVE-2022-0466

Inappropriate implementation in Extensions Platform in Google Chrome prior to 98.0.4758.80 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page...

CVE-2022-0466

Inappropriate implementation in Extensions Platform in Google Chrome prior to 98.0.4758.80 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page...

CVE-2022-0462

Inappropriate implementation in Scroll in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2022-0462

CVE-2022-0462 involves Google Chrome (Chromium-based) where an inappropriate implementation in Scroll could allow a remote attacker to leak cross-origin data via a crafted HTML page, affecting versions prior to 98.0.4758.80. The issue was addressed in Chrome 98.0.4758.80/98.0.4758.81/98.0.4758.82...

CVE-2022-0455

Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 98.0.4758.80 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2022-0804

Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 99.0.4844.51 allowed a remote attacker to hide the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2022-0802

Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 99.0.4844.51 allowed a remote attacker to hide the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2022-0610

Inappropriate implementation in Gamepad API in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

CVE-2022-0610

Inappropriate implementation in Gamepad API in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Inappropriate Implementation

chromium is vulnerable to Inappropriate implementation.The vulnerability exist in Extensions in the library, which allows an attacker to convince user to install a malicious extension to leak potentially sensitive information via a crafted HTML page...

Business Logic Flaws

chromium is vulnerable to business logic flaws. The vulnerability exists due to inappropriate implementation in Virtual Keyboard which allows an attacker to perform unwanted actions...

Cloud Pentesting, Pt. 3: The Impact of Ecosystem Maturity

Now that we’ve covered the basics of cloud pentesting and the style in which a cloud environment could be attacked, let’s turn our attention to the entirety of this ecosystem. This environment isn’t too different from the on-premise ecosystem that traditional penetration testing is performed on...

Add a timelock to PaladinRewardReserve functions

Lines of code Vulnerability details Impact The owner of PaladinRewardReserve can approve and transfer any amount of tokens with no limits on any account. This is not good for investors. To give more trust to users: these functions should be put behind a timelock. Proof of Concept Tools Used VS Co...

Chromium: CVE-2022-1137 Inappropriate implementation in Extensions

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

USN-5362-1: Linux kernel (Intel IOTG) vulnerabilities

Nick Gregory discovered that the Linux kernel incorrectly handled network offload functionality. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. CVE-2022-25636 Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano Giuffrida...

USN-5358-2 linux-aws-5.4, linux-aws-5.13, linux-azure, linux-azure-5.4, linux-azure-fde, linux-gcp, linux-gcp-5.13, linux-gcp-5.4, linux-gke, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-ibm, linux-ibm-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities

It was discovered that the network traffic control implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-1055 It was discovered that the IPsec implementati...

Demystifying XDR: The Time for Implementation Is Now

In previous installments of our conversation with Forrester Analyst Allie Mellen on all things extended detection and response XDR, she helped us understand not only the foundations of the product category and its relationship with security information and event management SIEM, but also the role...

[SECURITY] Fedora 36 Update: rust-regex-1.5.5-1.fc36

Implementation of regular expressions for Rust. This implementation uses fini te automata and guarantees linear time matching on all inputs...

[SECURITY] Fedora 36 Update: jxrlib-1.1-20.fc36

This is an open source implementation of the jpegxr image format standard...

LSN-0085-1 Kernel Live Patch Security Notice

Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 releaseagent feature. A local attacker could use this to gain administrative privileges.CVE-2022-0492 Nick Gregory discovered that the Linux kernel incorrectly...