FreeBSD : chromium -- multiple vulnerabilities (e1100e63-92f7-11e7-bd95-e8e0b747a45a)

Google Chrome releases reports : 22 security fixes in this release, including : - 737023 High CVE-2017-5111: Use after free in PDFium. Reported by Luat Nguyen on KeenLab, Tencent on 2017-06-27 - 740603 High CVE-2017-5112: Heap buffer overflow in WebGL. Reported by Tobias Klein on 2017-07-10 -...

Google Chrome < 61.0.3163.79 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 61.0.3163.79. It is, therefore, affected by multiple vulnerabilities as referenced in the 201709stable-channel-update-for-desktop advisory. - Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, a...

Vulnerability Spotlight: Content Security Policy bypass in Microsoft Edge, Google Chrome and Apple Safari

The vulnerabilities were discovered by Nicolai Grdum of Cisco.Today, Talos is releasing details of vulnerabilities discovered in Microsoft Edge browser as well as older versions of Google Chrome CVE-2017-5033 and browsers based on the Webkit such as Apple Safari CVE-2017-2419 . An attacker may be...

CVE-2017-5118

Blink in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, failed to correctly propagate CSP restrictions to javascript scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page...

Microsoft Edge Content Security Bypass Vulnerability

Summary An exploitable information leak vulnerability exists in the Content Security Policy enforcement functionality of Microsoft Edge 40.15063.0.0. A specially crafted web page can cause a content security policy bypass resulting in an information leak. An attacker can create a malicious webpag...

Mozilla: CSP directives improperly applied with sandbox flag in iframes (MFSA 2017-19)

When a page's content security policy CSP header contains a "sandbox" directive, other directives are ignored. This results in the incorrect enforcement of CSP. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox 55...

Unikrn: HTML injection in email in unikrn.com

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Please add the affected...

SNMP polling information disclosure vulnerability in multiple Cisco products

The Cisco Web Security Appliance WSA, Email Security Appliance ESA, and Content Security Management Appliance SMA are all products of Cisco, Inc.Cisco WSA is a Web security appliance. The Cisco WSA is a Web Security Appliance, the ESA is an Email Security Appliance, and the Content SMA is a Conte...

CVE-2017-6783

A vulnerability in SNMP polling for the Cisco Web Security Appliance WSA, Email Security Appliance ESA, and Content Security Management Appliance SMA could allow an authenticated, remote attacker to discover confidential information about the appliances that should be available only to an...

CVE-2017-6783

A vulnerability in SNMP polling for the Cisco Web Security Appliance WSA, Email Security Appliance ESA, and Content Security Management Appliance SMA could allow an authenticated, remote attacker to discover confidential information about the appliances that should be available only to an...

CVE-2017-6783

CVE-2017-6783 affects Cisco Web Security Appliance (WSA), Email Security Appliance (ESA), and Content Security Management Appliance (SMA). The root cause is that these devices do not protect confidential information at rest in SNMP poll responses, enabling an authenticated, remote attacker to dis...

Cisco Content Security Management Appliance SNMP Polling Information Disclosure Vulnerability (cisco-sa-20170816-csa)

A vulnerability in SNMP polling for the Cisco Content Security Management Appliance SMA could allow an authenticated, remote attacker to discover confidential information about the appliances that should be available only to an administrative user. SPDX-FileCopyrightText: 2017 Greenbone AG Some...

Legal Robot: CSP script-src includes "unsafe-inline"

A security researcher pointed out that our Content Security Policy included the unsafe-eval keyword in the script-src directive. I pointed out some low level issue in CSP policy. and great fix by legalrobot team...

Mozilla: CSP directives improperly applied with sandbox flag in iframes (MFSA 2017-19)

When a page's content security policy CSP header contains a "sandbox" directive, other directives are ignored. This results in the incorrect enforcement of CSP. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox 55...

CVE-2017-7808

A content security policy CSP "frame-ancestors" directive containing origins with paths allows for comparisons against those paths instead of the origin. This results in a cross-origin information leak of this path information. This vulnerability affects Firefox 55...

UBUNTU-CVE-2017-7803

When a page's content security policy CSP header contains a "sandbox" directive, other directives are ignored. This results in the incorrect enforcement of CSP. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox 55...

CVE-2017-7803

When a page's content security policy CSP header contains a "sandbox" directive, other directives are ignored. This results in the incorrect enforcement of CSP. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox 55...

CVE-2017-7788

When an "iframe" has a "sandbox" attribute and its content is specified using "srcdoc", that content does not inherit the containing page's Content Security Policy CSP as it should unless the sandbox attribute included "allow-same-origin". This vulnerability affects Firefox 55...

UBUNTU-CVE-2017-7788

When an "iframe" has a "sandbox" attribute and its content is specified using "srcdoc", that content does not inherit the containing page's Content Security Policy CSP as it should unless the sandbox attribute included "allow-same-origin". This vulnerability affects Firefox 55...

UBUNTU-CVE-2017-7808

A content security policy CSP "frame-ancestors" directive containing origins with paths allows for comparisons against those paths instead of the origin. This results in a cross-origin information leak of this path information. This vulnerability affects Firefox 55...