CVE-2023-26081
Published Feb 20, 2023In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts.
Vendor/product archive
gnome / epiphany CVEs
Beta · best-effort13 CVEs tagged to gnome / epiphany — 0 Critical, 6 High, 7 Medium, 0 Low, 0 Unrated.
CVE-2022-29536
Published Apr 20, 2022In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long page title. The iss…
CVE-2021-45088
Published Dec 16, 2021XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page.
CVE-2021-45087
Published Dec 16, 2021XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by a a page title.
CVE-2021-45086
Published Dec 16, 2021XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js.
CVE-2021-45085
Published Dec 16, 2021XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a user visits an XSS payload page often…
CVE-2019-6251
Published Jan 14, 2019WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be d…
CVE-2018-12016
Published Jun 7, 2018libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via certain window.open and document.write cal…
CVE-2018-11396
Published May 23, 2018ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that tri…
CVE-2017-1000025
Published Jul 17, 2017GNOME Web (Epiphany) 3.23 before 3.23.5, 3.22 before 3.22.6, 3.20 before 3.20.7, 3.18 before 3.18.11, and prior versions, is vulnerable to a password manager sweep attack resultin…
CVE-2010-3312
Published Oct 14, 2010Epiphany 2.28 and 2.29, when WebKit and LibSoup are used, unconditionally displays a closed-lock icon for any URL beginning with the https: substring, without any warning to the u…
CVE-2008-5985
Published Jan 28, 2009Untrusted search path vulnerability in the Python interface in Epiphany 2.22.3, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python…
CVE-2005-0238
Published May 2, 2005The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certific…
Showing 1-13 of 13 CVEsPage 1 of 1