Search criteria

3 vulnerabilities found for oculus_browser by oculus

FKIE_CVE-2019-3562

Vulnerability from fkie_nvd - Published: 2019-04-29 16:29 - Updated: 2024-11-21 04:42
Severity
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the Oculus Browser starting from version 5.2.7 until 5.7.11.
References
cve-assign@fb.comhttps://www.facebook.com/security/advisories/cve-2019-3562Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.facebook.com/security/advisories/cve-2019-3562Third Party Advisory
Impacted products
Vendor Product Version
oculus oculus_browser *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oculus:oculus_browser:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "91679425-9381-4723-AB36-282A5BDAAB07",
              "versionEndIncluding": "5.7.11",
              "versionStartIncluding": "5.2.7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the Oculus Browser starting from version 5.2.7 until 5.7.11."
    },
    {
      "lang": "es",
      "value": "Una p\u00e1gina web remota podr\u00eda inyectar c\u00f3digo HTML arbitrario en la interfaz de usuario del navegador Oculus, permitiendo que un atacante falsifique la interfaz de usuario y potencialmente ejecute c\u00f3digo. Esto afecta al navegador Oculus desde la versi\u00f3n 5.2.7 hasta la 5.7.11."
    }
  ],
  "id": "CVE-2019-3562",
  "lastModified": "2024-11-21T04:42:10.267",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-04-29T16:29:00.983",
  "references": [
    {
      "source": "cve-assign@fb.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.facebook.com/security/advisories/cve-2019-3562"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.facebook.com/security/advisories/cve-2019-3562"
    }
  ],
  "sourceIdentifier": "cve-assign@fb.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ],
      "source": "cve-assign@fb.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2019-3562 (GCVE-0-2019-3562)

Vulnerability from cvelistv5 – Published: 2019-04-29 15:32 – Updated: 2024-08-04 19:12
VLAI
Summary
A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the Oculus Browser starting from version 5.2.7 until 5.7.11.
Severity
No CVSS data available.
CWE
  • CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component (CWE-74)
Assigner
References
Impacted products
Vendor Product Version
Oculus Oculus Browser Affected: 5.7.11
Affected: 5.2.7 , < unspecified (custom)
Unaffected: unspecified , < 5.2.7 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:12:09.679Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.facebook.com/security/advisories/cve-2019-3562"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oculus Browser",
          "vendor": "Oculus",
          "versions": [
            {
              "status": "affected",
              "version": "5.7.11"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "5.2.7",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.7",
              "status": "unaffected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "dateAssigned": "2019-03-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the Oculus Browser starting from version 5.2.7 until 5.7.11."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (CWE-74)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-04-29T15:32:45.000Z",
        "orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
        "shortName": "facebook"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.facebook.com/security/advisories/cve-2019-3562"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-assign@fb.com",
          "DATE_ASSIGNED": "2019-03-28",
          "ID": "CVE-2019-3562",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Oculus Browser",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "!=\u003e",
                            "version_value": "5.7.11"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "5.2.7"
                          },
                          {
                            "version_affected": "!\u003c",
                            "version_value": "5.2.7"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oculus"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the Oculus Browser starting from version 5.2.7 until 5.7.11."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (CWE-74)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.facebook.com/security/advisories/cve-2019-3562",
              "refsource": "MISC",
              "url": "https://www.facebook.com/security/advisories/cve-2019-3562"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
    "assignerShortName": "facebook",
    "cveId": "CVE-2019-3562",
    "datePublished": "2019-04-29T15:32:45.000Z",
    "dateReserved": "2019-01-02T00:00:00.000Z",
    "dateUpdated": "2024-08-04T19:12:09.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-3562 (GCVE-0-2019-3562)

Vulnerability from nvd – Published: 2019-04-29 15:32 – Updated: 2024-08-04 19:12
VLAI
Summary
A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the Oculus Browser starting from version 5.2.7 until 5.7.11.
Severity
No CVSS data available.
CWE
  • CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component (CWE-74)
Assigner
References
Impacted products
Vendor Product Version
Oculus Oculus Browser Affected: 5.7.11
Affected: 5.2.7 , < unspecified (custom)
Unaffected: unspecified , < 5.2.7 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:12:09.679Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.facebook.com/security/advisories/cve-2019-3562"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oculus Browser",
          "vendor": "Oculus",
          "versions": [
            {
              "status": "affected",
              "version": "5.7.11"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "5.2.7",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.7",
              "status": "unaffected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "dateAssigned": "2019-03-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the Oculus Browser starting from version 5.2.7 until 5.7.11."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (CWE-74)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-04-29T15:32:45.000Z",
        "orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
        "shortName": "facebook"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.facebook.com/security/advisories/cve-2019-3562"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-assign@fb.com",
          "DATE_ASSIGNED": "2019-03-28",
          "ID": "CVE-2019-3562",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Oculus Browser",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "!=\u003e",
                            "version_value": "5.7.11"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "5.2.7"
                          },
                          {
                            "version_affected": "!\u003c",
                            "version_value": "5.2.7"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oculus"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the Oculus Browser starting from version 5.2.7 until 5.7.11."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (CWE-74)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.facebook.com/security/advisories/cve-2019-3562",
              "refsource": "MISC",
              "url": "https://www.facebook.com/security/advisories/cve-2019-3562"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
    "assignerShortName": "facebook",
    "cveId": "CVE-2019-3562",
    "datePublished": "2019-04-29T15:32:45.000Z",
    "dateReserved": "2019-01-02T00:00:00.000Z",
    "dateUpdated": "2024-08-04T19:12:09.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}