5526 matches found
CVE-2018-7491
PrestaShop
CVE-2018-7491
In PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking vulnerability was found that might lead to state-changing impact in the context of a user or an admin, because the generateHtaccess function in classes/Tools.php sets neither X-Frame-Options nor 'Content-Security-Policy "frame-ancestors'...
QIWI: Imformation Disclosure on id.rapida.ru
Привет, Происходит раскрытие путей на id.rapida.ru/dp.php Шаги для воспроизведения: 1 Перейти на https://id.rapida.ru/login 2 Попробовать авторизоваться через телефон, ожидая смс-код. 3 Попробовать ввести не рабочий смс кодлюбой 4 В респонсе можно увидеть пути HTTP/1.1 200 OK Server: nginx Date:...
GLSA-201802-02 : Chromium, Google Chrome: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-201802-02 Chromium, Google Chrome: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the referenced CVE identifiers and Google Chrome Releases for details. Impact :...
CVE-2018-0140
A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the spam quarantine by modifying browser string information. The vulnerability is due to a lack of...
CVE-2018-0140
A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the spam quarantine by modifying browser string information. The vulnerability is due to a lack of...
Design/Logic Flaw
A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the spam quarantine by modifying browser string information. The vulnerability is due to a lack of...
CVE-2018-0140
A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the spam quarantine by modifying browser string information. The vulnerability is due to a lack of...
CVE-2018-0140
The CVE-2018-0140 issue affects Cisco Email Security Appliance (ESA) and Cisco Content Security Management Appliance (CSMA). It stems from a lack of verification of authenticated user accounts, enabling an authenticated remote attacker to download arbitrary messages from the spam quarantine by mo...
CVE-2017-15387
Insufficient enforcement of Content Security Policy in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to open javascript: URL windows when they should not be allowed to via a crafted HTML page...
CVE-2017-15387
Insufficient enforcement of Content Security Policy in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to open javascript: URL windows when they should not be allowed to via a crafted HTML page...
CVE-2017-15387
Insufficient enforcement of Content Security Policy in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to open javascript: URL windows when they should not be allowed to via a crafted HTML page...
Design/Logic Flaw
Insufficient enforcement of Content Security Policy in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to open javascript: URL windows when they should not be allowed to via a crafted HTML page...
UBUNTU-CVE-2017-15387
Insufficient enforcement of Content Security Policy in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to open javascript: URL windows when they should not be allowed to via a crafted HTML page...
CVE-2017-15387
Insufficient enforcement of Content Security Policy in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to open javascript: URL windows when they should not be allowed to via a crafted HTML page...
CVE-2017-15387
CVE-2017-15387 affects Chromium/Blink; before 62.0.3202.62 there was insufficient enforcement of Content Security Policy, allowing a remote attacker to open javascript: URLs via a crafted HTML page. Affected software is the Chromium browser (Blink engine) prior to 62.0.3202.62. Remediation is to ...
CVE-2017-15387
Removed by vendor...
Cisco Email Security Appliance and Cisco Content Security Management Appliance Spam Quarantine Vulnerability
A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the spam quarantine by modifying browser string information. The vulnerability is due to a lack of...
The vulnerability in the implementation of the CSP mechanism in Mozilla Firefox, Firefox ESR, and the email client Thunderbird allows attackers to perform cross-site scripting attacks.
The vulnerability of the Content Security Policy mechanism implemented in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to the lack of measures taken to protect the structure of web pages using the sandbox directive. Exploiting this vulnerability allows a remote attack...
The vulnerability in the implementation of the Content Security Policy mechanism for Mozilla Firefox, Firefox ESR, and the email client Thunderbird allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Content Security Policy mechanism implemented by Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to the improper implementation of the “sandbox” directive. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to...