Apache Struts 6.0.0 <=> 6.10.0 / 7.0.0 <=> 7.2.1 Denial of Service (S2-073)

The version of Apache Struts installed on the remote host is 6.0.0 prior to 6.11.0, or 7.0.0 prior to 7.3.0. It is, therefore, affected by a denial of service vulnerability as referenced in the S2-073 advisory. - Struts provides an optional facility for collecting Content Security Policy violatio...

EUVD-2014-1667

Malware in sbrugna...

USN-2917-3 firefox regressions

USN-2917-1 fixed vulnerabilities in Firefox. This update caused several web compatibility regressions. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS. If a user were tricked in...

Path traversal

The Content Security Policy CSP implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of a ServiceWorker fetch, which allows remote attackers to obtain sensitive information about visited web pages by reading CSP violation report...

CVE-2016-2845

Removed by vendor...

CVE-2016-2845: Exposure of Sensitive Information to an Unauthorized Actor

The Content Security Policy CSP implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of a ServiceWorker fetch, which allows remote attackers to obtain sensitive information about visited web pages by reading CSP violation report...

UBUNTU-CVE-2016-2845

The Content Security Policy CSP implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of a ServiceWorker fetch, which allows remote attackers to obtain sensitive information about visited web pages by reading CSP violation report...

CVE-2014-1591: Undefined Security Weakness

Mozilla Firefox 33.0 and SeaMonkey before 2.31 include path strings in CSP violation reports, which allows remote attackers to obtain sensitive information via a web site that receives a report after a redirect...

CVE-2011-2990

The implementation of Content Security Policy CSP violation reports in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, and possibly other products does not remove proxy-authorization credentials from the listed request headers, which allows attackers to obtain sensitive information by...