211 matches found
CVE-2019-5824
Parameter passing error in media in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
CVE-2019-5824
Parameter passing error in media in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
CVE-2016-7404
OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform...
OPENSUSE-SU-2019:1488-1 Security update for chromium
This update for chromium fixes the following issues: Chromium was updated to 74.0.3729.157: - Various security fixes from internal audits, fuzzing and other initiatives Includes security fixes from 74.0.3729.131 boo1134218: - CVE-2019-5827: Out-of-bounds access in SQLite - CVE-2019-5824: Paramete...
CVE-2019-5824
Parameter passing error in media in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
Arbitrary Code Execution
kernel-rt is vulnerable to arbitrary code execution. The vulnerability exists as it uses incorrect uid and gid values during credentials passing in the scmsetcred function...
Stable Channel Update for Desktop
The stable channel has been updated to 74.0.3729.131 for Windows, Mac, and Linux, which will roll out over the coming days/weeks. Security Fixes and Rewards Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain...
SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2018:3476-1)
This update for MozillaFirefox to 60.2.2ESR fixes the following issues : Security issues fixed : MFSA 2018-24 : CVE-2018-12386: A Type confusion in JavaScript allowed remote code execution bsc1110506 CVE-2018-12387: Array.prototype.push stack pointer vulnerability may have enabled exploits in the...
U.S. Dept Of Defense: Unencrypted __VIEWSTATE parameter in a DoD website
Hi there i realise that the information passing to the server in the subdomain http://████████ can be seen without any encryption thought the VIEWSTATE Parameter. To reduce the change of someone interception the information the parameter should be encrypted due to the sensivity of the information...
Debian DSA-4289-1 : chromium-browser - security update
Several vulnerabilities have been discovered in the chromium web browser. - CVE-2018-16065 Brendon Tiszka discovered an out-of-bounds write issue in the v8 JavaScript library. - CVE-2018-16066 cloudfuzzer discovered an out-of-bounds read issue in blink/webkit. - CVE-2018-16067 Zhe Jin discovered ...
Memory Corruption Vulnerability in NAPro
Nanda Aotuo Technology Jiangsu Co., Ltd. specializes in the research, development, production and sales of programmable logic controllers PLC, has formed a large and medium-sized PLC products as the main products, supplemented by small PLC products, remote measurement and control unit RTU, touch...
Memory Corruption Vulnerability in NA-VIEW
Nanda Aotuo Technology Jiangsu Co., Ltd. specializes in the research, development, production and sales of programmable logic controllers PLC, has formed a large and medium-sized PLC products as the main products, supplemented by small PLC products, remote measurement and control unit RTU, touch...
Kicking the Rims – A Guide for Securely Writing and Auditing Chrome Extensions
Table of Contents A Thin Layer of Chrome Extension Security Prior-Art Isolated But Talkative Worlds A Quick Disclaimer Home is Where the manifest.json Is - The Basic Extension Layout The Extension Architecture, Namespace Isolation and the DOM The Same Origin Policy SOP in the Chrome Extension Wor...
Reading Your Emails With A Read&Write Chrome Extension Same Origin Policy Bypass (~8 Million Users Affected)
Summary Due to a lack of proper origin checks in the message passing from regular web pages, any arbitrary web page is able to call privileged background page APIs for the Read&Write Chrome extension vulnerable version 1.8.0.139. Many of these APIs allow for dangerous actions which are not meant ...
Reading Your Emails With A Read&Write Chrome Extension Same Origin Policy Bypass (~8 Million Users Affected)
Summary Due to a lack of proper origin checks in the message passing from regular web pages, any arbitrary web page is able to call privileged background page APIs for the Read&Write Chrome extension vulnerable version 1.8.0.139. Many of these APIs allow for dangerous actions which are not meant ...
Google Android Qualcomm Closed Source Component Buffer Overflow Vulnerability
Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA in the U.S. Qualcomm is one of the Qualcomm components used in Qualcomm devices. A buffer overflow vulnerability exists in the Qualcomm closed-source component in Android, which...
Code injection
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer sizes in the message passing interface are not properly validated...
CVE-2017-14917
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer sizes in the message passing interface are not properly validated...
CVE-2017-14916
CVE-2017-14916 describes a buffer size validation issue in the message passing interface within Android for MSM, Firefox OS for MSM, and QRD Android (CAF Linux kernel). The flaw arises from improper validation of buffer sizes, enabling a potential high-impact, network-exposed condition with remot...
CVE-2017-7550
A flaw was found in the way Ansible 2.3.x before 2.3.3, and 2.4.x before 2.4.1 passed certain parameters to the jenkinsplugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in th...