Content Spoofing

chromium is vulnerable to content spoofing. An insecure implementation allows an attacker who has compromised the renderer process to spoof contents of the Omnibox via a malicious HTML page...

Arbitrary Code Execution

chromium is vulnerable to arbitrary code execution. A heap-based buffer overflow in V8 allows a remote attacker to execute arbitrary code on the host OS via a heap corruption via a malicious HTML page...

Arbitrary Code Execution

chromium is vulnerable to arbitrary code execution. A heap-based buffer overflow in Skia allows a remote attacker to exploit a heap corruption and execute arbitrary code on the host OS via a malicious HTML page...

Dell iDRAC XSS (DSA-2020-268)

Dell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web application. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to...

Logitech: Stored XSS on oslo.io in notifications via project name change

Hey Logitech team. Summary: It is possible for an editor on a project to rename a project to a malicious HTML element, which when opened in the notification dropdown will render and fire javascript. Steps To Reproduce: add details for how we can reproduce the issue 1. Invite user to join the...

Information Disclosure

chromium is vulnerable to information disclosure. Side-channel information leakage in autofill allows a remote attacker to obtain confidential information from process memory via a malicious HTML page...

Arbitrary Code Execution

chromium is vulnerable to arbitrary code execution. Heap buffer overflow in WebAudio allows a remote attacker to exploit a heap corruption via a malicious HTML page...

Content-Security Policy Bypass

chromium is vulnerable to content-security policy bypass. Insufficient policy enforcement in CSP allows a remote attacker to bypass content security policy via a malicious HTML page...

CVE-2020-26198

Dell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web application. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to...

CVE-2020-26198

Dell EMC iDRAC9 is affected by a reflected cross-site scripting (XSS) vulnerability in the web UI for versions prior to 4.32.10.00 and 4.40.00.00. A remote attacker could lure a victim to a crafted link to execute malicious HTML/JavaScript in the browser. Public references indicate the vulnerabil...

Arbitrary Code Execution

chromium is vulnerable to arbitrary code execution. Insufficient checks of pointer validity in WebRTC allows a remote attacker to exploit a heap corruption and execute arbitrary code on the host OS via a malicious HTML page...

squid: Improper input validation in request allows for proxy manipulation

A flaw was found in squid. The absolute URL of a request can include the decoded UserInfo username and password for certain protocols. This decoded info may contain special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a...

CVE-2020-15930

An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag...

CVE-2020-5334

RSA Archer, versions prior to 6.7 P2 6.7.0.2, contains a Document Object Model DOM based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM...

The vulnerability of Google Chrome’s browser-based music acquisition mechanism allows attackers to gain unauthorized access to confidential data, cause service interruptions, and compromise data integrity.

The vulnerability of Google Chrome’s browser-music acquisition mechanism is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential data, cause service failures, and compromise data integrity through the...

DEBIAN-CVE-2019-12520

An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo...

The vulnerability of the Omnibox mechanism in the Google Chrome browser, related to the lack of a mechanism for checking entered data, allows a perpetrator to compromise the integrity of the data.

The vulnerability of the Omnibox mechanism in the Google Chrome browser is related to the lack of a mechanism for verifying the entered data. Exploiting this vulnerability allows an attacker to manipulate the integrity of data by creating a malicious HTML page...

The vulnerability of Google Chrome’s mechanism for processing external browser protocols lies in the lack of a mechanism for checking entered data. This allows attackers to compromise the integrity of the data.

The vulnerability of Google Chrome’s mechanism for processing external browser protocols is related to the lack of a mechanism for checking entered data. Exploiting this vulnerability allows an attacker to influence the integrity of data by creating a malicious HTML page...

Arbitrary Code Execution

thunderbird/firefox is vulnerable to arbitrary code execution. Several flaws were found in the processing of malformed HTML content. Malicious HTML content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird...

Arbitrary Code Execution

thunderbird is vulnerable to arbitrary code execution. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running...