11168 matches found
GitHub Security Lab: Java: CWE-749 Unsafe resource loading in Android WebView leaking to injection attacks
This bug was reported directly to GitHub Security Lab...
Cross-site Scripting (XSS)
react-native-webview is vulnerable to cross-site scripting XSS. The vulnerability exists through the lack of policy enforcement that allows cross-origin iframes to execute arbitrary JavaScript in the top-level document. The vulnerability exists on all applications running on systems with an Andro...
Android WebView Universal Cross-site Scripting
A universal cross-site scripting UXSS vulnerability, CVE-2020-6506 https://crbug.com/1083819, has been identified in the Android WebView system component, which allows cross-origin iframes to execute arbitrary JavaScript in the top-level document. This vulnerability affects React Native apps whic...
GHSA-36J3-XXF7-4PQG Android WebView Universal Cross-site Scripting
A universal cross-site scripting UXSS vulnerability, CVE-2020-6506 https://crbug.com/1083819, has been identified in the Android WebView system component, which allows cross-origin iframes to execute arbitrary JavaScript in the top-level document. This vulnerability affects React Native apps whic...
Universal XSS in Android WebView
Overview A universal cross-site scripting UXSS vulnerability, CVE-2020-6506 https://crbug.com/1083819, has been identified in the Android WebView system component, which allows cross-origin iframes to execute arbitrary JavaScript in the top-level document. This vulnerability affects React Native...
The vulnerability of the Microsoft Xamarin.Forms user interface platform, the WebView component for displaying web pages, and the Google Chrome browser is related to errors in the user interface’s information presentation. This allows attackers to perform spear-phishing attacks.
The vulnerability of the Microsoft Xamarin.Forms user interface platform, including the WebView component for displaying web pages and the Google Chrome browser, is related to errors in the user interface’s information presentation. Exploiting this vulnerability can allow a remote attacker to...
Cross-site Scripting (XSS)
Overview react-native-webview is a React Native WebView component for iOS, Android, macOS, and Windows Affected versions of this package are vulnerable to Cross-site Scripting XSS. A universal cross-site scripting UXSS vulnerability has been identified in the Android WebView system component, whi...
LY Corporation: Webview in LINE client for iOS will render application/octet-stream files as HTML
Due to misconfiguration in the webview of LINE client for iOS, the data with header "Content-type" as "application/octet-stream" was treated as HTML. This could lead to a malicious Javascript execution, resulting a Cross-site scripting attack...
DEBIAN-CVE-2020-6538
Inappropriate implementation in WebView in Google Chrome on Android prior to 84.0.4147.105 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2020-6538
Inappropriate implementation in WebView in Google Chrome on Android prior to 84.0.4147.105 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2020-6538
Inappropriate implementation in WebView in Google Chrome on Android prior to 84.0.4147.105 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2020-6538
Inappropriate implementation in WebView in Google Chrome on Android prior to 84.0.4147.105 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
UBUNTU-CVE-2020-6538
Inappropriate implementation in WebView in Google Chrome on Android prior to 84.0.4147.105 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2020-6538
Inappropriate implementation in WebView in Google Chrome on Android prior to 84.0.4147.105 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2020-6538
CVE-2020-6538 affects Google Chrome WebView on Android (inappropriate WebView implementation) allowing cross-origin data leakage via a crafted HTML page. Connected sources indicate the issue was fixed in Chrome/Chromium releases around 84.0.4147.105; Debian’s advisory lists CVE-2020-6538 among up...
CVE-2020-6538
Inappropriate implementation in WebView in Google Chrome on Android prior to 84.0.4147.105 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2020-5629
UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via a malicious App created by the third party. As a result, if the access destination is a malicious website, the user may fall victim to the social engineering attack...
CVE-2020-16873
A spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on Android WebView version prior to 83.0.4103.106. This vulnerability could allow an attacker to execute arbitrary Javascript code on a target system. For the attack to be successful, the targeted user would...
Spoofing
A spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on Android WebView version prior to 83.0.4103.106. This vulnerability could allow an attacker to execute arbitrary Javascript code on a target system. For the attack to be successful, the targeted user would...
CVE-2020-16873
The CVE-2020-16873 entry describes a spoofing vulnerability in Microsoft Xamarin.Forms tied to the Android WebView default settings before 83.0.4103.106. The issue allows an attacker to execute arbitrary Javascript if a user visits a malicious website or a site serving malicious code via Xamarin....