Cisco Email Security Appliance, Cisco Content Security Management Appliance, and Cisco Web Security Appliance Information Disclosure Vulnerability

A vulnerability in the authentication for the general purpose APIs implementation of Cisco Email Security Appliance ESA, Cisco Content Security Management Appliance SMA, and Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to access general system information and...

The vulnerability of the CSP mechanism (Content Security Policy in Mozilla Firefox) allows attackers to perform cross-site scripting attacks.

The vulnerability of the CSP mechanism in Mozilla Firefox’s browser is related to the failure to protect the structure of a web page when loading the “data:” URL. Exploiting this vulnerability allows an attacker to perform cross-site scripting attacks remotely...

The vulnerability of the Content Security Policy mechanism implemented by Mozilla Firefox’s browser allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Content Security Policy CSP implementation in Mozilla Firefox is related to security flaws when using the “frame-ancestors” directive. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Mozilla Firefox browser, related to a bug in the inheritance of content security policies, allows attackers to circumvent security restrictions.

The vulnerability of the Mozilla Firefox browser is related to a bug in the inheritance of security policies for web content. Exploiting this vulnerability can allow an attacker operating remotely to circumvent security restrictions...

CVE-2020-26287

HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary script tags in HedgeDoc notes using mermaid diagrams. Our content security policy prevents loading scripts from most locations, but www.google-analytics.com is...

Design/Logic Flaw

HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary script tags in HedgeDoc notes using mermaid diagrams. Our content security policy prevents loading scripts from most locations, but www.google-analytics.com is...

CVE-2020-26287 Stored XSS in mermaid diagrams

HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary script tags in HedgeDoc notes using mermaid diagrams. Our content security policy prevents loading scripts from most locations, but www.google-analytics.com is...

CVE-2020-26287

Summary (CVE-2020-26287) : HedgeDoc prior to version 1.7.1 is vulnerable to cross-site scripting through injection of arbitrary [removed] tags in notes created via mermaid diagrams. The underlying issue stems from a permissive content security policy that allowed loading scripts from certain orig...

Hedgedoc 跨站脚本漏洞

Hedgedoc is a Javascript-based Markdown document real-time editing and sharing platform by the Hedgedoc team. A security vulnerability exists in HedgeDoc versions prior to 1.7.1, which can be exploited to inject arbitrary "script" tags into HedgeDoc notes. Our content security policy prohibits...

Arbitrary Code Execution

chromium is vulnerable to arbitrary code execution. The vulnerability exists through insufficient data validation in webUI that allows a local attacker to bypass content security policy via a crafted HTML page...

Information Disclosure

chromium is vulnerable to information disclosure. Inappropriate implementation in Content Security Policy allows a remote attacker to leak cross-origin data via a malicious HTML page...

Information Leak

chromium, sid is vulnerable to information leak in content security policy in Google Chrome. It allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Authorization Bypass

chromium is vulnerable to authorization bypass. The vulnerability exists through a policy bypass in CSPthat allows a remote attacker to bypass content security policy via a crafted HTML page...

Content-Security Policy Bypass

chromium is vulnerable to content-security policy bypass. Insufficient policy enforcement in CSP allows a remote attacker to bypass content security policy via a malicious HTML page...

DEBIAN-CVE-2020-26958

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox 83, Firefox ESR 78.5,...

CVE-2020-26958

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox 83, Firefox ESR 78.5,...

Design/Logic Flaw

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox 83, Firefox ESR 78.5,...

CVE-2020-26958

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox 83, Firefox ESR 78.5,...

CVE-2020-26958

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox 83, Firefox ESR 78.5,...

CVE-2020-26958

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox 83, Firefox ESR 78.5,...