5520 matches found
MGASA-2021-0583 Updated webkit2 packages fix security vulnerability
Processing maliciously crafted web content may lead to unexpectedly unenforced Content Security Policy. CVE-2021-30887 Processing maliciously crafted web content may lead to universal cross site scripting. CVE-2021-30890...
Information Disclosure
webkit2gtk is vulnerable to information disclosure. The vulnerability exists via Content Security Policy redirect behavior...
CVE-2021-30888
An information leak flaw was found in WebKitGTK. A malicious web site using Content Security Policy reports could use this flaw to leak information via redirects...
CVE-2021-30887
A logic issue was found in WebKitGTK. A specially crafted web content could use this flaw to bypass Content Security Policy bypass when processed...
The vulnerability in the processing of CSP policies for Mozilla Firefox and Mozilla Thunderbird web browsers, related to security configuration errors, allows attackers to circumvent existing security restrictions.
The vulnerability of CSP policies for Mozilla Firefox and Mozilla Thunderbird browsers is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions by embedding additional content within documents...
Unsafe inline XSS in pasting DOM element into chat
Impact Inline scripts are executed when Javascript is parsed via a paste action. 1. Open https://watch.owncast.online/ 2. Copy and then paste into the chat field. 3. An alert should pop up. Patches ⋮ 13 │ // Content security policy ⋮ 14 │ csp := string ⋮ 15 │ "script-src 'self'...
CVE-2021-39183
Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a paste action. This issue is patched in 0.0.9 by blocking unsafe-inline Content Security Policy and specifying the script-src. The worker-sr...
CVE-2021-39183
Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a paste action. This issue is patched in 0.0.9 by blocking unsafe-inline Content Security Policy and specifying the script-src. The worker-sr...
CVE-2021-39183
Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a paste action. This issue is patched in 0.0.9 by blocking unsafe-inline Content Security Policy and specifying the script-src. The worker-sr...
Buffer overflow
Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a paste action. This issue is patched in 0.0.9 by blocking unsafe-inline Content Security Policy and specifying the script-src. The worker-sr...
CVE-2021-39183 Unsafe inline XSS Owncast
Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a paste action. This issue is patched in 0.0.9 by blocking unsafe-inline Content Security Policy and specifying the script-src. The worker-sr...
PT-2021-22441 · Owncast · Owncast
Name of the Vulnerable Software and Affected Versions: Owncast versions prior to 0.0.9 Description: The issue concerns the execution of inline scripts when Javascript is parsed via a paste action in the chat server. This can lead to the execution of malicious scripts. The problem is resolved by...
Mozilla: Bypass of CSP sandbox directive when embedding
Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...
Mozilla: Bypass of CSP sandbox directive when embedding
Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...
Mozilla: Bypass of CSP sandbox directive when embedding
Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...
CVE-2021-43532
The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows - in conjunction with a Content Security Policy that stopped a redirection chain in the middle - the final image URL could be one that contained an...
DEBIAN-CVE-2021-43543
Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...
UBUNTU-CVE-2021-43532
The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows - in conjunction with a Content Security Policy that stopped a redirection chain in the middle - the final image URL could be one that contained an...
Authentication flaw
The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows - in conjunction with a Content Security Policy that stopped a redirection chain in the middle - the final image URL could be one that contained an...
CVE-2021-43532
The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows - in conjunction with a Content Security Policy that stopped a redirection chain in the middle - the final image URL could be one that contained an...