CVE-2025-12435

Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-12430

Object lifecycle issue in Media in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: High...

CVE-2025-12430

Object lifecycle issue in Media in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: High...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, Inc USA. A security vulnerability exists in Google Chrome prior to version 142.0.7444.137, which stems from an improper implementation of Omnibox and could lead to a UI spoofing attack...

Cisco Unified Contact Center Express Path Traversal Vulnerability

Cisco Unified Contact Center Express Unified CCX is a customer relationship management component of a unified communications solution from Cisco. The component supports features such as self-service voice, call distribution, and customer access control. A path traversal vulnerability exists in...

EUVD-2025-38430

Malicious code in capes-ui npm...

CVE-2025-36135

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.71, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.71, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary...

CVE-2025-12911

CVE-2025-12911 affects Google Chrome before 140.0.7339.80 due to an Inappropriate implementation in Permissions, enabling a remote attacker to perform UI spoofing via a crafted HTML page. The issue is addressed in the Chrome 140 stable release (Chrome 140.0.7339.80 and later). Update to the lates...

CVE-2025-12911

Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

EUVD-2025-38339

Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

EUVD-2025-38302

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.71, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.71, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary...

CVE-2025-36135

CVE-2025-36135 affects IBM Sterling B2B Integrator and IBM Sterling File Gateway across multiple versions (6.0.0.0–6.1.2.7_1, 6.2.0.0–6.2.0.5, and 6.2.1.0). The vulnerability is Cross-Site Scripting (CWE-79) that allows an authenticated user to embed arbitrary JavaScript in the Web UI, potentiall...

keycloak: Keycloak error_description injection on error pages

A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading...

PT-2025-45486

Name of the Vulnerable Software and Affected Versions IBM Sterling B2B Integrator versions 6.0.0.0 through 6.1.2.7 1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 IBM Sterling File Gateway versions 6.0.0.0 through 6.1.2.7 1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 Description The software is susceptible to ...

CVE-2025-11212

Inappropriate implementation in Media in Google Chrome on Windows prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-11212

Inappropriate implementation in Media in Google Chrome on Windows prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-11208

Inappropriate implementation in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-11213

CVE-2025-11213 describes an Omnibox implementation issue in Google Chrome on Android that allows domain spoofing via a crafted HTML page when a user is persuaded to perform specific UI gestures. The available connected documents confirm a Chromium/Chrome family fix in the 141.0.7390.54+ range, wi...

CVE-2025-11213

Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-11212

CVE-2025-11212 concerns an inappropriate Media module implementation in Google Chrome on Windows, enabling domain spoofing when a user is induced to perform specific UI gestures on a crafted HTML page. The connected Fedora advisories indicate Chromium-based updates addressing this vulnerability: ...