Represented by AHEAD ↗, Carahsoft ↗, GuidePoint Security ↗, Kudelski Security ↗, Optiv ↗, Presidio ↗, TD SYNNEX ↗, World Wide Technology ↗
Google's zero trust implementation for secure access without VPN AI-generated from public sourcesThe starting point for every profile: auto-generated by 0-Doubt from public vendor materials, and not yet confirmed by the vendor or an independent analyst. Nothing here is hidden or overstated — it simply has not been reviewed yet.Where every profile starts, before the vendor or an analyst has reviewed it. A higher label means a more independent source — not a better product.How trust works →
Tools & products
We build profiles from public sources and haven't extracted a capability list for Google. Closest sources we do hold:
Integrated by: 1Kosmos, 1Password, 42Crunch, 6Wind, ACI Learning, ANY.RUN, AVG, Abbey Labs, Above Security, Abstract Security, AccuKnox, Acme Security EDR, Acronis International GmbH, Acsense, Acuity Risk Management, Adaptive, Adaptive Security, Ahsay Systems Corporation, AiStrike, Aikido Security, Akeyless Security, Alice, Amplify Security, Anchore, Andesite, Andromeda Security, Anecdotes, Anjuna Security, AnubisNetworks, Anvilogic, Aona AI, Apono, AppOmni, Approov, Apptega, Aqua Security, AquilaX, Arcanna.ai, Arize AI, Asenion, Astrix Security, Attaxion, Auconet, AuditBoard, AuthZed, Avatier, AvePoint, Aviatrix, Axcient, Axiom Security, Axoflow, BMC Software, Bastion, Beta Systems, BetterCloud, Beyond Identity, Bitwarden, Black Duck, Blackpoint Cyber, Blink Ops, Bolster, BrandShield, Bridewell, Britive, CHEQ, CMD+CTRL Security, Cakewalk, Cambridge Intelligence, Carbide, CardinalOps, Caveonix, Censys, Cequence Security, Chainguard, CheckRed, Cisco, Claroty, Cleafy, ClearDATA, Clerk, CloudDefense.AI, Cloudcheckr, Cloudsmith, Coalfire, Coalition, Codenotary, Cofense, Cohesive Networks, Collibra, Commvault, Comodo, Complyan, Complyance, Compyl, Concentric AI, ConductorOne, ConnectSecure, ConnectWise, LLC, ControlMap, Conveyor, Conviso, Coralogix, CoreStack, Corelight, Corgea, Corsica Cybersecurity, Cosmian, Cotool, Credas, Cribl, CrowdSec, CrowdStrike, CultureAI, Curricula, Cybeats, Cyber Aware, CyberGuard360, CyberProof, Cyberfort / Auriga, Cyberhaven, Cybervergent, Cyble, Cyera, Cyjax, Cylera, Cylus, Cyolo, Cypago, Cyrebro – CyberHat, Cyscale Limited, Cyver, D3 Security, DTS Systeme GmbH, Darktrace, Dastra, Data Theorem, DataBahn, Databricks, Datto, Daylight Security, Descope, DeviceLock, Devolutions, Devtron, Didomi, DigitSec, Digital Hands, Discern Security, Dispel, DoControl, Domino Data Lab, Doppel, Dropzone AI, Duality Technologies, Dune Security, Duo Security, Dymo, ELLIO, ESET, EasyDMARC, Echo, Echoworx, Edge Delta, EdgeBit, Edgeless Systems, Edgescan, Egnyte, Elastic, Embed Security, EmpowerID, Engage Black, Entitle, Entro Security, Equixly, Eureka Security, Exabeam, Exaforce, Exeon, Expel, ExtraHop, F5, FTAPI Software, Faddom, Fastly, Fencer, Fiddler AI, Fidelis Security, FileCloud, FireMon, Firezone, First Recon AI, Flare, Fleet Device Management, Fortanix, Fortinet, Frame Security, FusionAuth, GTB Technologies, Gigamon, GitLab, GoodAccess, Grip Security, Group IB, Guardian360, Gurucul, HYCU, Hadrian, Haekka, Halo Security, Heimdal Security, Herd Security, HeroDevs, Hicomply, HiddenLayer, Hideez, HiveMQ, Hook Security, Huntbase, Huntress, Hyperproof, Hysolate, IDEE, IRONSCALES, ISMS.online, ISO2HANDLE, Illumio, ImmuniWeb, Immuta, Imperum, Imperva, InCountry, Incode Technologies, Indusface, Infisical, Infoblox, Informatica, InstaSafe Technologies, Intermedia, Intezer, Intruder, Invicti, JFrog, Jamcracker, Jit, JumpCloud, Kaseya, Keepnet Labs, Kentik, Kertos, Kiteworks, Kloudle, Konvu, LEET Security, LMNTRIX, LastPass, LayerX, Legato Security, Legion Security, Lema, Lightbeam, Liongard, LogCraft, LoginRadius, Loginsoft, Lumos, Mage Data, ManagedMethods, Material Security, Menlo Security, Mesh Security, MessageSolution, Inc., Metomic, MindTheHack, Mindflow, Mitigant, Mitigata, Monad, Moxso, Mycroft, N-able, NIST, Nagomi Security, Native Security, NetBird, NetLib Security, NetScaler, Netenrich, Netmaker, NeuVector Inc., NightVision, Nightfall AI, NinjaOne, Nirmata, NordLayer, Nubo Software, Nucleus Security, Nudge Security, ORION, Obsidian Security, OctoXLabs, Offensive360, Offroad, Olakai, Oleria, OneSpan, OneTrust, Onspring, Onyx Security, Oomnitza, OpenText Cybersecurity, Operant AI, Opsin, Optimal IdM, Optro, Orca Security, Ory Corp, OutThink, Owl Browser, Ox Security, P0 Security, PII Tools, PKWARE, Inc., Palo Alto Networks, Panther, Parablu, Passguard, Pathlock, Pentera, Perimeter81, Permiso, PhishFirewall, PhishingBox, Phoenix Security, PitchPoint Solutions, PlaxidityX, Plerion, Plexicus, Ploy, PointGuard AI, Pomerium, Portkey, Portnox, Precisely, Prelude Security, Privacera, Privado, Progress – formerly ipswitch, Promptfoo, Proofpoint, Prophet Security, Protegrity, ProtonMail, Prowler, Push Security, Qevlar AI, QueryPie, QuilrAI, RackSpace, Rapid7, RapidFort, Reach Security, Reco, Red Canary, RedSeal, RegScale, Resecurity, Rhebo, Risk Cognizance, Riverbed, Ruckus – CommScope, Runlayer, S4E.io, SAI360 INC., SMARTFENSE, SOC Jedi.AI, SOFTwarfare, SUSE, Safe Security, SailPoint, Salt Security, SandboxAQ, Sandfly Security, Saporo, ScalePad, Scalekit, Scrut Automation, Scytale, Searchlight Cyber, SecLogic, Seceon Inc, Secretarium, SecurEnvoy, SecureSky, Secureframe, SecurelyShare, Seemplicity, Sekoia.io, Sennovate Inc, SentinelOne, Seraphic, Serval, Sevii, ShadowDragon, ShardSecure, ShareFile, Signaturit, Silence Laboratories, Silverfort, Simbian, Sinaptic.AI, Skyflow, Skyhigh Security, Smallstep, Smarttech247, Sn1perSecurity LLC, Snyk, SoSafe, Socket, Socura, Sola Security, Spirion, Splunk, SpyCloud, Stairwell, Stellar Cyber, Strac, StrangeBee, Stream.Security, Strobes Security, Sumo Logic, Superscript, SurePath AI, Suridata, Swif, Synqly, Sysdig, Systancia, TCPWave, TRaViS ASM, Tailscale, Talon Cyber Security, Tamnoon, Team Cymru, Teleport, Teleskope, Tenable, Tenzir, Terralogic, ThreatAware, ThreatDefence, ThreatDown by Malwarebytes, Tigera, Token Security, Torq, Tracebit, Transcend, Trend Micro, TrueFoundry, Truffle Security, Trust3 AI, TrustArc, TrustLayer, TrustLogix, TrustWorks, Trustero, Trustle, Tuskira, Twingate, Ubiq Security, Ubisecure, UncommonX, Uno, Unosecur, UpGuard, Upstream Security, Upwind, Usercentrics, Valence Security, Vali Cyber, Valimail, Vamu, Vanta, Vaultree, Vectra AI, Veeam Software, Versa Networks, Very Good Security (VGS), Veza, Vijil, Vijilan, Virtru, Vorlon, WPMissionControl, Wazuh, Webz.io, Whalemate, Whistic, Willow, Wiz, XFA, XM Cyber, Zenity, ZeroFox, Zimperium, Zluri, Zscaler, Zygon, Zynap, c/side, eMudhra, eSentire, elba, enclaive, eperi, furl, heylogin, hoop.dev, iDenfy, ipqualityscore, isMalicious, keepit, keyfactor, mondoo, netcraft, plainid, productiv, prove, rebasoft, revel8, rmail, runZero, secfix, smartertools, specterops, spin.ai, tetrate, torii, utimaco, velotix, viso trust, zentera
0 of 5 independent trust signals established
Nothing about Google has been independently confirmed yet. That is a starting point, not a finding — every profile begins here, and it says nothing about the product.
Not yet established: Independently verified · Operating durability · Behaviour under stress · Disclosure posture · Momentum
Has anyone other than the vendor confirmed this?
Nothing here has been confirmed by an independent third party yet.
Is this a real, durable business?
How long this vendor has been operating, and who stands behind them.
What do they do when something goes wrong?
What their public record shows about handling vulnerabilities and outages.
Do they tell you the awkward things unprompted?
How much this vendor volunteers before you have to ask.
Are they still shipping, or coasting?
Whether this vendor is visibly still building.
Security headers (1/5) — checked 10/18/2026
Infrastructure & transparency signals
13 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.
Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.
PHP remote file inclusion vulnerability in admin.googlebase.php in the Ecom Solutions VirtueMart Google Base (aka com_googlebase or Froogle) component 1.1 for J…
Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, when use…
Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x befor…
Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive…
Cross-site scripting (XSS) vulnerability in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to inject arbitrary Java…
Google Chrome before 4.0.249.89, when a SOCKS 5 proxy server is configured, sends DNS queries directly, which allows remote DNS servers to obtain potentially sensitive information about the identity o…
Google Chrome before 4.0.249.89 attempts to make direct connections to web sites when all configured proxy servers are unavailable, which allows remote HTTP servers to obtain potentially sensitive inf…
browser/login/login_prompt.cc in Google Chrome before 4.0.249.89 populates an authentication dialog with credentials that were stored by Password Manager for a different web site, which allows user-as…
Integer overflow in Google SketchUp before 7.1 M2 allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via a crafted SKP file.
Array index error in Jan Eric Kyprianidis lib3ds 1.x, as used in Google SketchUp 7.x before 7.1 M2, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitra…
WebKit before r53607, as used in Google Chrome before 4.0.249.89, allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's U…
SQL injection vulnerability in the Google Calendar GCalendar (com_gcalendar) component 1.1.2, 2.1.4, and possibly earlier versions for Joomla! allows remote attackers to execute arbitrary SQL commands…
The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS requ…
The WebFrameLoaderClient::dispatchDidChangeLocationWithinPage function in src/webkit/glue/webframeloaderclient_impl.cc in Google Chrome before 3.0.195.32 allows user-assisted remote attackers to cause…
WebKit before r50173, as used in Google Chrome before 3.0.195.32, allows remote attackers to cause a denial of service (CPU consumption) via a web page that calls the JavaScript setInterval method, wh…
The Gears plugin in Google Chrome before 3.0.195.32 allows user-assisted remote attackers to cause a denial of service (memory corruption and plugin crash) or possibly execute arbitrary code via unspe…
Incomplete blacklist vulnerability in browser/download/download_exe.cc in Google Chrome before 3.0.195.32 allows remote attackers to force the download of certain dangerous files via a "Content-Dispos…
Google Chrome, possibly 3.0.195.21 and earlier, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-midd…
Google Chrome 1.0.154.48 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an automatically submitted form containing a KEYGEN element, a related issue to CVE-2009…
The getSVGDocument method in Google Chrome before 3.0.195.21 omits an unspecified "access check," which allows remote web servers to bypass the Same Origin Policy and conduct cross-site scripting atta…
Cross-site scripting (XSS) vulnerability in Google Chrome 2.x and 3.x before 3.0.195.21 allows remote attackers to inject arbitrary web script or HTML via a (1) RSS or (2) Atom feed, related to the re…
Google Chrome 0.2.149.29 and earlier allows remote attackers to cause a denial of service (unusable browser) by calling the window.print function in a loop, aka a "printing DoS attack," possibly a rel…
Google Chrome 1.0.154.48 and earlier, 2.0.172.28, 2.0.172.37, and 3.0.193.2 Beta does not properly block data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross…
Google Chrome 1.0.154.65, 1.0.154.48, and earlier allows remote attackers to (1) cause a denial of service (application hang) via vectors involving a chromehtml: URI value for the document.location pr…
Google Chrome before 2.0.172.43 does not prevent SSL connections to a site with an X.509 certificate signed with the (1) MD2 or (2) MD4 algorithm, which makes it easier for man-in-the-middle attackers…
Google V8, as used in Google Chrome before 2.0.172.43, allows remote attackers to bypass intended restrictions on reading memory, and possibly obtain sensitive information or execute arbitrary code in…
The tooltip manager (chrome/views/tooltip_manager.cc) in Google Chrome 0.2.149.29 Build 1798 and possibly other versions before 0.2.149.30 allows remote attackers to cause a denial of service (CPU con…
Google Chrome 1.0.154.48 and earlier allows remote attackers to cause a denial of service (CPU consumption and application hang) via JavaScript code with a long string value for the hash property (aka…
Stack-based buffer overflow in chrome/common/gfx/url_elider.cc in Google Chrome 0.2.149.27 and other versions before 0.2.149.29 might allow user-assisted remote attackers to execute arbitrary code via…
Google Chrome 0.2.149.27 allows user-assisted remote attackers to cause a denial of service (browser crash) via an IMG tag with a long src attribute, which triggers the crash when the victim performs …
Google Chrome BETA (0.2.149.27) does not prompt the user before saving an executable file, which makes it easier for remote attackers or malware to cause a denial of service (disk consumption) or expl…
Integer underflow in net/base/escape.cc in chrome.dll in Google Chrome 0.2.149.27 allows remote attackers to cause a denial of service (browser crash) via a URI with an invalid handler followed by a "…
Stack-based buffer overflow in the SaveAs feature (SaveFileAsWithFilter function) in win_util.cc in Google Chrome 0.2.149.27 allows user-assisted remote attackers to execute arbitrary code via a web p…
Google Chrome 2.x through 2.0.172 allows remote attackers to cause a denial of service (application crash) via a long Unicode string argument to the write method, a related issue to CVE-2009-2479.
Google Chrome before 2.0.172.37 allows attackers to leverage renderer access to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified v…
Heap-based buffer overflow in src/jsregexp.cc in Google V8 before 1.1.10.14, as used in Google Chrome before 2.0.172.37, allows remote attackers to execute arbitrary code in the Chrome sandbox via a c…
Google Chrome 1.0.154.48 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors relat…
Buffer overflow in the browser kernel in Google Chrome before 2.0.172.33 allows remote HTTP servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted re…
Google Chrome before 1.0.154.53 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary …
Google Chrome detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by…
src/net/http/http_transaction_winhttp.cc in Google Chrome before 1.0.154.53 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a pr…
Use-after-free vulnerability in WebKit, as used in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome 1.0.154.53, and possibly other produc…
Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3 and 4 Public Beta, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chro…
Google Chrome executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PDF file, which might allow remote attackers to bypas…
Multiple integer overflows in Skia, as used in Google Chrome 1.x before 1.0.154.64 and 2.x, and possibly Android, might allow remote attackers to execute arbitrary code in the renderer process via a c…
Heap-based buffer overflow in the ParamTraits<SkBitmap>::Read function in Google Chrome before 1.0.154.64 allows attackers to leverage renderer access to cause a denial of service (application crash) …
Google Chrome 1.0.154.53 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a throw statement with a long exception value.
Google Chrome 2.0.x lets modifications to the global object persist across a page transition, which makes it easier for attackers to conduct Universal XSS attacks via unspecified vectors.
Google Chrome 1.0.x does not cancel timeouts upon a page transition, which makes it easier for attackers to conduct Universal XSS attacks by calling setTimeout to trigger future execution of JavaScrip…
Argument injection vulnerability in the chromehtml: protocol handler in Google Chrome before 1.0.154.59, when invoked by Internet Explorer, allows remote attackers to determine the existence of files,…
Multiple SQL injection vulnerabilities in Shader TV (Beta) allow remote authenticated administrators to execute arbitrary SQL commands via the sid parameter to (1) kanal.asp, (2) google.asp, and (3) h…
Cross-domain vulnerability in the WorkerPool API in Google Gears before 0.5.4.2 allows remote attackers to bypass the Same Origin Policy and the intended access restrictions of the allowCrossOrigin fu…
PHP remote file inclusion vulnerability in admin.googlebase.php in the Ecom Solutions VirtueMart Google Base (aka com_googlebase or Froogle) component 1.1 for Joomla! allows remote attackers to execut…
Google Chrome before 1.0.154.46 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive info…
Cross-domain vulnerability in the V8 JavaScript engine in Google Chrome before 1.0.154.46 allows remote attackers to bypass the Same Origin Policy via a crafted script that accesses another frame and …
Google Chrome 1.0.154.43 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a crafted element to the current mouse position, related to a "Clickjac…
An unspecified function in the JavaScript implementation in Google Chrome creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote atta…
Argument injection vulnerability in Google Chrome 1.0.154.36 on Windows XP SP3 allows remote attackers to execute arbitrary commands via the --renderer-path option in a chromehtml: URI. NOTE: a third…
Google Hack Honeypot (GHH) File Upload Manager 1.3 allows remote attackers to delete uploaded files via unknown vectors related to the delall action to index.php. NOTE: the provenance of this informa…
Multiple cross-site scripting (XSS) vulnerabilities in Google Chrome 0.2.149.30 allow remote attackers to inject arbitrary web script or HTML via an ftp:// URL for an HTML document within a (1) JPG, (…
Google Chrome 0.2.149.29 and 0.2.149.30 allows remote attackers to cause a denial of service (memory consumption) via an HTML document containing a carriage return ("\r\n\r\n") argument to the window.…
The SAML Single Sign-On (SSO) Service for Google Apps allows remote service providers to impersonate users at arbitrary service providers via vectors related to authentication responses that lack a re…
Multiple integer overflows in Python before 2.5.2 might allow context-dependent attackers to have an unknown impact via vectors related to (1) Include/pymem.h; (2) _csv.c, (3) _struct.c, (4) arraymodu…
Heap-based buffer overflow in the GIF library in the WebKit framework for Google Android SDK m3-rc37a and earlier allows remote attackers to execute arbitrary code via a crafted GIF file whose logical…
Integer overflow in the BMP::readFromStream method in the libsgl.so library in Google Android SDK m3-rc37a and earlier, and m5-rc14, allows remote attackers to execute arbitrary code via a crafted BMP…
The Custom Button Installer dialog in Google Toolbar 4 and 5 beta presents certain domain names in the (1) "Downloaded from" and (2) "Privacy considerations" sections without verifying domain names, w…
Unspecified vulnerability in the benchmark reporting system in Google Web Toolkit (GWT) before 1.4.61 has unknown impact and attack vectors, possibly related to cross-site scripting (XSS).
Cross-site scripting (XSS) vulnerability in Google Mini Search Appliance 3.4.14 allows remote attackers to inject arbitrary web script or HTML via the ie parameter to the /search URI.
Cross-site scripting (XSS) vulnerability in session.cgi (aka the login page) in Google Urchin 5 5.7.03 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string, …
report.cgi in Google Urchin allows remote attackers to bypass authentication and obtain sensitive information (web server logs) via certain modified query parameters, as demonstrated using the profile…
Google Picasa allows remote attackers to read image files stored by Picasa via unspecified vectors involving a picasa:// URI. NOTE: this information is based upon a vague pre-advisory.
Multiple buffer overflows in Google Picasa have unspecified attack vectors and impact. NOTE: this information is based upon a vague pre-advisory.
Multiple cross-application scripting (XAS) vulnerabilities in Google Picasa have unspecified attack vectors and impact. NOTE: this information is based upon a vague pre-advisory.
Cross-site scripting (XSS) vulnerability in search.php in Google Custom Search Engine allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: this issue is disputed …
Google Desktop allows user-assisted remote attackers to execute arbitrary programs via a man-in-the-middle attack that injects JavaScript, a www.google.com search IFRAME, and a META HTTP-EQUIV="refres…
Multiple PHP remote file inclusion vulnerabilities in the creator in vBulletin Google Yahoo Site Map (vBGSiteMap) 2.41 for vBulletin allow remote attackers to execute arbitrary PHP code via a URL in t…
The Google Web Toolkit (GWT) framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page t…
Buffer overflow in Google Earth v4.0.2091 (beta) allows remote user-assisted attackers to cause a denial of service (crash) via a KML or KMZ file with a long href element.
Cross-site scripting (XSS) vulnerability in Google Desktop allows remote attackers to bypass protection schemes and inject arbitrary web script or HTML, and possibly gain full access to the system, by…
Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, when used with Internet Explorer, Google Chrome,…
Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x befor…
Cross-site scripting (XSS) vulnerability in Google Search Appliance and Google Mini allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded q parameter.
The Gabriele Teotino GNotebook 0.7.0.1 gadget for Google Desktop stores Gmail passwords in plaintext in the %SYSTEMDRIVE%\temp\Gnotebook.txt log file, which allows local users to obtain passwords by r…
Multiple cross-site scripting (XSS) vulnerabilities in Zend Google Data Client Library (ZendGData) Preview 0.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameter…
Multiple SQL injection vulnerabilities in the Google Gadget login.php (gadget/login.php) in Rob Hensley ackerTodo 4.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) u…
Google Mini 4.4.102.M.36 and earlier allows remote attackers to obtain sensitive information via a direct request for /search with an invalid client parameter, which reveals the path in an error messa…
Multiple cross-site scripting (XSS) vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to inject arbitrary web script or HTML via the (1) ICQ, (2) AIM, (3) MSN, (4) Google Talk, (5) Website N…
Multiple SQL injection vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to execute arbitrary SQL commands via the (1) id, (2) forumid, or (3) threadid parameter to index.php; the (4) ICQ, (…
Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains th…
The automatic update feature in Google Talk allows remote attackers to cause a denial of service (CPU and memory consumption) by poisoning a target's DNS cache and causing a large update file to be se…
Cross-site scripting (XSS) vulnerability in index.php in Google API Search 1.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via hex-encoded values in the REQ parameter.
Directory traversal vulnerability in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to determine the existence of arbitrary files via a relative path from …
Cross-site scripting (XSS) vulnerability in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to inject arbitrary Javascript, and possibly other web script or…
The Saxon XSLT parser in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to obtain sensitive information and execute arbitrary code via dangerous Java class…
Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to port scan arbitrary hosts via URLs with modified targets and ports, then comparing the resulting error me…
Cross-site scripting (XSS) vulnerability in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to inject arbitrary Javascript, and possibly other web script or…
Google Talk before 1.0.0.76, with email notification enabled, allows remote attackers to cause a denial of service (connection reset) via email with a blank sender.
Cross-site scripting (XSS) vulnerability in Google Toolbar 2.0.114.1 allows remote attackers to inject arbitrary web script via about.html in the About section. NOTE: some followup posts suggest that…
The Google toolbar 1.1.58 and earlier allows remote web sites to perform unauthorized toolbar operations including script execution and file reading in other zones such as "My Computer" by opening a w…
The Google toolbar 1.1.58 and earlier allows remote web sites to monitor a user's input into the toolbar via an "onkeydown" event handler.
The Google toolbar 1.1.60, when running on Internet Explorer 5.5 and 6.0, allows remote attackers to cause a denial of service (crash with an exception in oleaut32.dll) via malicious HTML, possibly re…
Not a quality rating or endorsement — a measure of how much verified, disclosed data we actually have about this vendor. A low score usually means "we don't have much verified information yet," not "this is a bad vendor." Never used to sort or rank vendor lists.
The platform admin controls the formula's weights.
Product information on this page is auto-generated by 0-Doubt from public sources and not yet confirmed by the vendor or an independent analyst, unless an item is individually labelled otherwise. How trust works →