Zhiyang Zeng

An inconsistent user interface issue was addressed with improved state management. Visiting a malicious website may lead to address bar spoofing.

The issue is related to an insufficient data validation mechanism in the external protocol handling of Google Chrome. This can be exploited by a remote attacker using a crafted HTML page, potentially affecting data integrity.

A memory corruption issue was addressed with improved state management. Processing maliciously crafted web content may lead to arbitrary code execution. The issue is related to a buffer overflow in the WebKit module, which can allow a remote attacker to execute arbitrary code.

The issue involves the `LinkPresentation` component and allows remote attackers to spoof the UI via a crafted URL in a text message.

The issue involves the Safari component and allows remote attackers to spoof the user interface via a crafted web site.

An issue in Safari allows remote attackers to spoof the address bar via a crafted web site, involving the Safari component.

The issue involves the WebKit Page Loading component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site.

The issue involves the Safari component and allows remote attackers to spoof the address bar via a crafted web site.

An issue in Safari allows remote attackers to spoof the address bar via a crafted web site, involving the Safari component.

The issue allows Directory Traversal via the `pathfolder` parameter in the smilie module.

The issue allows attackers to perform a Cross-Site Request Forgery (CSRF) attack, enabling them to install any themes via a GET request.

The issue allows attackers to change plugin settings due to a CSRF problem.

The issue is related to a Stored XSS that allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is due to the lack of the serendipity event xsstrust plugin and a set config error in that plugin.

The issue concerns the Email MyCode component, which allows for cross-site scripting (XSS) attacks. This is demonstrated through the use of an onmouseover event.

The issue allows remote attackers to bypass an SSRF protection mechanism.