Redhat » Enterprise Linux Server : Security Vulnerabilities, CVEs, Published In 2020 (XSS) CVSS score >= 3
Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.
Max CVSS
4.3
EPSS Score
0.37%
Published
2020-02-11
Updated
2022-04-06
Insufficient validation of untrusted input in Blink in Google Chrome prior to 80.0.3987.87 allowed a local attacker to bypass content security policy via a crafted HTML page.
Max CVSS
4.3
EPSS Score
0.27%
Published
2020-02-11
Updated
2022-04-11
When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.
Max CVSS
6.1
EPSS Score
0.35%
Published
2020-01-08
Updated
2020-01-13
When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.
Max CVSS
6.1
EPSS Score
0.45%
Published
2020-01-08
Updated
2020-01-13
4 vulnerabilities found