CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2023-26081
https://notcve.org/view.php?id=CVE-2023-26081
In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts. • https://github.com/google/security-research/security/advisories/GHSA-mhhf-w9xw-pp9x https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1275 https://lists.debian.org/debian-lts-announce/2023/05/msg00015.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFWUNG6E4ZT43EYNHKYXS7QVSO2VW2H2 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SADQCSQKTJKTTIJMEPY7GII6IVQSKEKV • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2022-29536
https://notcve.org/view.php?id=CVE-2022-29536
In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long page title. The issue occurs because the number of bytes for a UTF-8 ellipsis character is not properly considered. En GNOME Epiphany versiones anteriores a 41.4 y versiones 42.x anteriores a 42.2, un documento HTML puede desencadenar un desbordamiento del búfer del cliente (en ephy_string_shorten en el proceso de la interfaz de usuario) por medio de un título de página largo. El problema es producido porque el número de bytes para un carácter de elipsis UTF-8 no es considerado apropiadamente • https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1106 https://lists.debian.org/debian-lts-announce/2022/08/msg00006.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLLDMY4JYDZTMZSCPSY23K5YW3SQYUR6 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7YWVIUGFRA6GOE3QAPSJJ6EL3DJG5NX https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5K5UPNHVWXDPSMBNSB2645MD2N5CXQS https://www.debian.org/security/ • CWE-787: Out-of-bounds Write •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2021-45086
https://notcve.org/view.php?id=CVE-2021-45086
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js. Un ataque de tipo XSS puede ocurrir en GNOME Web (también se conoce como Epiphany) versiones anteriores a 40.4 y 41.x versiones anteriores a 41.1, porque el suggested_filename de un servidor es usado como el valor pdf_name en PDF.js • https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612 https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045 https://www.debian.org/security/2022/dsa-5042 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 1CVE-2021-45087
https://notcve.org/view.php?id=CVE-2021-45087
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by a a page title. Un ataque de tipo XSS puede ocurrir en GNOME Web (también se conoce como Epiphany) versiones anteriores a 40.4 y 41.x versiones anteriores a 41.1, cuando es usado el modo Ver Fuente o el modo Lector, como lo demuestra un título de página • https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612 https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045 https://lists.debian.org/debian-lts-announce/2022/08/msg00006.html https://www.debian.org/security/2022/dsa-5042 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 1CVE-2021-45088
https://notcve.org/view.php?id=CVE-2021-45088
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page. Un ataque de tipo XSS puede ocurrir en GNOME Web (también se conoce como Epiphany) versiones anteriores a 40.4 y 41.x versiones anteriores a 41.1 por medio de una página de error • https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612 https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045 https://lists.debian.org/debian-lts-announce/2022/08/msg00006.html https://www.debian.org/security/2022/dsa-5042 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •