Zhiyang Zeng

Um problema de inconsistência na interface do usuário foi corrigido com um gerenciamento de estado aprimorado. Acessar um site malicioso pode levar à falsificação da barra de endereços.

The issue is related to an insufficient data validation mechanism in the external protocol handling of Google Chrome. This can be exploited by a remote attacker using a crafted HTML page, potentially affecting data integrity.

A memory corruption issue was addressed with improved state management. Processing maliciously crafted web content may lead to arbitrary code execution. The issue is related to a buffer overflow in the WebKit module, which can allow a remote attacker to execute arbitrary code.

The issue involves the `LinkPresentation` component and allows remote attackers to spoof the UI via a crafted URL in a text message.

The issue involves the Safari component and allows remote attackers to spoof the user interface via a crafted web site.

An issue in Safari allows remote attackers to spoof the address bar via a crafted web site, involving the Safari component.

The issue involves the WebKit Page Loading component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site.

The issue involves the Safari component and allows remote attackers to spoof the address bar via a crafted web site.

An issue in Safari allows remote attackers to spoof the address bar via a crafted web site, involving the Safari component.

The issue allows Directory Traversal via the `pathfolder` parameter in the smilie module.

The issue allows attackers to perform a Cross-Site Request Forgery (CSRF) attack, enabling them to install any themes via a GET request.

The issue allows attackers to change plugin settings due to a CSRF problem.

The issue is related to a Stored XSS that allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is due to the lack of the serendipity event xsstrust plugin and a set config error in that plugin.

The issue concerns the Email MyCode component, which allows for cross-site scripting (XSS) attacks. This is demonstrated through the use of an onmouseover event.

The issue allows remote attackers to bypass an SSRF protection mechanism.