5527 matches found
Google Chrome CSP Policy Bypass Vulnerability
Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A CSP policy bypass vulnerability exists in versions prior to Google Chrome 84.0.4147.89, no detailed vulnerability details are available at this time...
Google Chrome Information Leakage Vulnerability
Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. An information leakage vulnerability exists in the content security policy in versions prior to Google Chrome 84.0.4147.89, which can be exploited by attackers to...
U.S. Dept Of Defense: RXSS - ████
Hello, friends today when I was checking some sites I found this bug on your own website. Detalis XSS Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web...
WordPress: Clickjacking on donation page
Description: Vulnerable URL: https://wordpressfoundation.org/donate/ Clickjacking on the vulnerable URL allows an attacker to redirect a victim to do a donation at an attacker's page. Steps To Reproduce: 1 To test whether the page is vulnerable to clickjacking or not use this code i Frame THIS PA...
CVE-2020-2214
Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download...
CVE-2020-2214
Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download...
Design/Logic Flaw
Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download...
CVE-2020-2214
Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download...
CVE-2020-2214
CVE-2020-2214: Jenkins ZAP Pipeline Plugin ≤1.9 disables Content-Security-Policy for user-generated content in workspaces, archived artifacts, and related download paths, enabling cross-site scripting risks. Affected software spans the ZAP Pipeline Plugin (1.9 and earlier) and various Jenkins ver...
PT-2020-15429 · Jenkins · Jenkins +1
Name of the Vulnerable Software and Affected Versions: Jenkins ZAP Pipeline Plugin versions 1.9 and earlier Jenkins versions prior to 2.228 excluding 2.227 and older, 2.204.5 and older, due to different security concerns Jenkins versions 2.228 through 2.230 Jenkins 2.222.x LTS versions Jenkins...
Hackers Using Google Analytics to Bypass Web Security and Steal Credit Cards
Researchers reported on Monday that hackers are now exploiting Google's Analytics service to stealthily pilfer credit card information from infected e-commerce sites. According to several independent reports from PerimeterX, Kaspersky, and Sansec, threat actors are now injecting data-stealing cod...
The vulnerability of the Google Chrome browser’s media subsystem, which allows a hacker to circumvent content security policies
The vulnerability of the Google Chrome browser’s media subsystem exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass content security policies by using a specially crafted HTML page...
jenkins: Content-Security-Policy headers for files uploaded leads to XSS
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability...
jenkins: Content-Security-Policy headers for files uploaded leads to XSS
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability...
jenkins: Content-Security-Policy headers for files uploaded leads to XSS
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability...
The vulnerability of the Jenkins automation server, related to the absence of the HTTP header Content-Security-Policy, allows attackers to execute cross-site scripting (XSS) attacks.
The vulnerability of the Jenkins automation server is related to the absence of the HTTP header Content-Security-Policy. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting XSS attacks remotely...
CVE-2020-6501
Insufficient policy enforcement in CSP in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML page...
Unspecified Vulnerability in Google Chrome CSP
Google Chrome is a web browser from Google, Inc.CSP is a content security policy plugin. A security vulnerability exists in CSP in versions of Google Chrome prior to 80.0.3987.87, which stems from the program's failure to adequately enforce policies, and can be exploited by a remote attacker to...