Page 4 - Chromium Embedded Framework News Today : Breaking News, Live Updates & Top Stories | Vimarsana

Stay updated with breaking news from Chromium embedded framework. Get real-time updates on events, politics, business, and more. Visit us for reliable news and exclusive interviews.

Top News In Chromium Embedded Framework Today - Breaking & Trending Today

Cisco 9.9/10-severity bug: Patch these dangerous Jabber flaws for Windows, macOS

SEE:
(TechRepublic Premium)
Cisco says the bugs allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges or gain access to sensitive information . Customers have no other option but to install the latest updates to prevent attacks.
Norwegian security outfit Watchcom found earlier this year that Jabber was vulnerable to cross-site scripting (XSS) through XHTML-IM messages. Jabber did not properly sanitize incoming HTML messages and instead passed them through a faulty XSS filter.
Cisco notes that the new message-handling vulnerabilities can be exploited if an attacker can send Extensible Messaging and Presence Protocol (XMPP) messages to end-user systems running Cisco Jabber. ....

Fredrik Bugge Lyche , Chromium Embedded Framework , Techrepublic Premium , Extensible Messaging , Presence Protocol , Fredrik Bugge , Cisco Jabber , குரோமியம் பதிக்கப்பட்ட கட்டமைப்பு , ப்ரெஸெந்ஸ் ப்ரோடொகால் , சிஸ்கோ ஜாபர் ,

The patch that wasn't: Cisco emits fresh fixes for NTLM hash-spilling vuln and XSS-RCE combo in Jabber app

Wormable nasty still doesn t need any user input to pwn target devices
Gareth Corfield
Thu 10 Dec 2020 // 17:30 UTC
Share
Copy
A previous patch for Cisco s Jabber chat product did not in fact fix four vulnerabilities – including one remote code execution (RCE) flaw that would allow malicious people to hijack targeted devices by sending a carefully crafted message.
Norwegian infosec biz Watchcom spotted the vulnerabilities, having been asked by a client to verify that a previous patch for CVE-2020-26085 worked as advertised. Instead Watchcom found that the September update didn t fix the underlying problems.
A cross-site scripting (XSS) vuln leading to an RCE, CVE-2020-26085 was rated at 9.9 on the 10-point CVSS v3 scale, falling squarely into the critical bracket. It was uncovered by Watchcom in June this year and Cisco issued patches on 2 September that allegedly fixed it, as well as three other vulns. ....

Chromium Embedded Framework , Cisco Jabber , குரோமியம் பதிக்கப்பட்ட கட்டமைப்பு , சிஸ்கோ ஜாபர் ,