curl: Cookie injection for other servers

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar...

CVE-2017-7815

On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Javascript that will have an arbitrary domains as the dialog's location, spoofing of the origin of the modal dialog from the user view. Note: This attack only affects installations with e10 multiproce...

CVE-2017-7815

The CVE-2017-7815 entry relates to Mozilla Firefox's handling of iframe pages where the data: protocol can trigger a Javascript modal dialog that points to an arbitrary domain, potentially spoofing the origin seen by the user. This vulnerability affects Firefox versions before 56 (i.e., Firefox &...

Medium: wget

Issue Overview: A cookie injection flaw was found in wget. An attacker can create a malicious website which, when accessed, overrides cookies belonging to arbitrary domains.CVE-2018-0494 Affected Packages: wget Issue Correction: Run yum update wget or yum update --advisory ALAS-2018-1040 to updat...

Mail.ru: Possibility to view subdepartments for arbitrary domain

By directly referencing to department ID in biz.mail.ru, it was possible to see the names of departments without knowledge of which organization this department belongs to Leakage of every existing department/unit of every domain via changing parameters directly in http request...

Debian Security Advisory DSA 3705-1 (curl - security update)

Several vulnerabilities were discovered in cURL, an URL transfer library: CVE-2016-8615 It was discovered that a malicious HTTP server could inject new cookies for arbitrary domains into a cookie jar. CVE-2016-8616 It was discovered that when re-using a connection, curl was doing case insensitive...

ThisData: Host Header Poisoning in thisdata.com

ThisData made inappropriate use of the user-supplied host header, which could have resulted in a user being redirected to an arbitrary domain under some circumstances. On other pages, the header was used within metadata values like the canonical URL. 7H0R4PP4N was very thorough and helpful as we...

CVE-2015-8570

The password reset functionality in Lepide Active Directory Self Service allows remote authenticated users to change arbitrary domain user passwords via a crafted request...

MS14-075: Vulnerabilities in Microsoft Exchange Server Could Allow Elevation of Privilege (3009712)

The version of Microsoft Exchange installed on the remote host is affected by multiple vulnerabilities : - A token spoofing vulnerability exists due to Microsoft Outlook Web App OWA not properly validating request tokens. A remote attacker can exploit this vulnerability by convincing a user to...

SuSE9 Security Update : epiphany (YOU Patch Number 12519)

This update brings the Mozilla SeaMonkey Suite packages to the current stable release 1.1.17. Due to the major version update some incompatibilities might appear. It fixes all currently published security issues, including but not limited to : - Same-origin violations when Adobe Flash loaded via...

SuSE 11 Security Update : MozillaFirefox (SAT Patch Number 1001)

The Mozilla Firefox browser was updated to version 3.0.11, fixing various bugs and security issues : - Crashes with evidence of memory corruption rv:1.9.0.11. MFSA 2009-24 / CVE-2009-1392 / CVE-2009-1832 / CVE-2009-1833 - bmo479413 URL spoofing with invalid unicode characters. MFSA 2009-25 /...

Mozilla Foundation Security Advisory 2009-26

Mozilla Foundation Security Advisory 2009-26 Title: Arbitrary domain cookie access by local file: resources Impact: Moderate Announced: June 11, 2009 Reporter: Gregory Fleischer Products: Firefox, SeaMonkey Fixed in: Firefox 3.0.11 SeaMonkey 1.1.17 Description Security researcher Gregory Fleische...

Mozilla Firefox 1.0/1.5 XBL - MOZ-BINDING Property Cross-Domain Scripting

source: https://www.securityfocus.com/bid/16427/info Mozilla Firefox is prone to a security vulnerability that may let a Web page execute malicious script code in the context of an arbitrary domain. The issue affects the '-moz-binding' property. This could allow a malicious site to access the...