Lebr0Nli

Incorrect authorization in Blink allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from one origin can interact with a resource from another origin, by using a crafted HTML page.

A mitigation bypass exists within the DOM security component. The Document Object Model (DOM) is a programming interface for web documents that represents the page so that programs can change the document structure, style, and content.

A privilege escalation issue exists within the DOM: Workers component.

Processing maliciously crafted web content may allow a bypass of the Content Security Policy (CSP), a security layer that helps detect and mitigate certain types of attacks, including cross-site scripting and data injection. This issue occurs due to insufficient enforcement within AudioWorklet contexts, which are used for low-latency audio processing in the browser.

A mitigation bypass exists within the DOM Security component.

Insufficient validation of untrusted input in DevTools allows an attacker to bypass navigation restrictions. This occurs when a user is convinced to install a crafted malicious Chrome Extension.

Insufficient policy enforcement in DevTools allows an attacker to bypass navigation restrictions. This occurs when a user is convinced to install a malicious Chrome Extension, which can then be used to execute the bypass.

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55 Description A policy bypass issue existed in ServiceWorkers within Google Chrome before version 147.0.7727.55. A remote attacker could bypass the content security policy by using a specially crafted HTML page. Recommendations Update Google Chrome to version 147.0.7727.55 or later.

A flaw exists in the Google Chrome DevTools web development toolkit's data protection mechanism. Successful exploitation could allow a remote attacker to bypass security restrictions by loading a malicious extension. This could occur if a user is convinced to install a malicious extension. Insufficient policy enforcement in DevTools allowed bypassing enterprise host restrictions for cookie modification via a crafted Chrome Extension.

An OS command injection issue has been reported, allowing authenticated users to execute commands via a network.

An issue in Zimbra Collaboration allows authenticated users to exploit Server-Side Request Forgery (SSRF) due to improper input sanitization and misconfigured domain whitelisting. This permits unauthorized HTTP requests to be sent to internal services, potentially leading to Remote Code Execution (RCE) by chaining Command Injection within the internal service. When combined with existing XSS vulnerabilities, this SSRF issue can further facilitate Remote Code Execution (RCE).

The issue arises from improper validation of the length of server-side inputs in a specific API. This can be exploited by unauthenticated remote attackers when a user visits a spoofed website, leading to a stack-based buffer overflow that temporarily disrupts the service.

The issue is related to the insufficient encryption strength of authorization keys. A remote attacker can exploit this by tricking a victim into visiting a malicious website, which TCBServiSign will then treat as a legitimate server and interact with.

The issue concerns improper validation of server-side input in a specific API. This can be exploited by unauthenticated remote attackers when a user visits a spoofed website, allowing them to modify the `HKEY CURRENT USER` registry and execute arbitrary commands.

The issue concerns improper validation of server-side input in a specific API. This allows unauthenticated remote attackers to cause TCBServiSign to load a DLL from an arbitrary path when a user visits a spoofed website.

The issue concerns a specific API in TCBServiSign that fails to properly validate the length of server-side input. This can be exploited by unauthenticated remote attackers when a user visits a spoofed website, leading to a stack-based buffer overflow that temporarily disrupts the service of TCBServiSign.

The issue arises when the `AppImage` version of ImageMagick sets the `MAGICK CONFIGURE PATH` and `LD LIBRARY PATH` environment variables to an empty path during execution. This could potentially lead to arbitrary code execution by loading malicious configuration files or shared libraries in the current working directory.

A path traversal vulnerability has been reported to affect QuFirewall. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network.

A path traversal issue has been reported, allowing authenticated administrators to read the contents of unexpected files and expose sensitive data via a network.

An OS command injection issue has been reported, potentially allowing authenticated users to execute commands via a network. The vulnerability is related to insufficient protection of the web page structure, which could enable a remote attacker to execute arbitrary commands.