CVE-2019-11737

If a wildcard '' is specified for the host in Content Security Policy CSP directives, any port or path restriction of the directive will be ignored, leading to CSP directives not being properly applied to content. This vulnerability affects Firefox 69...

CVE-2019-11737

CVE-2019-11737 affects Firefox prior to version 69. If a wildcard '*' is used for the host in Content Security Policy directives, any port or path restriction of the directive is ignored, causing CSP directives not to be properly enforced on content. The issue is a CSP host wildcard handling flaw...

CVE-2019-11737

If a wildcard '' is specified for the host in Content Security Policy CSP directives, any port or path restriction of the directive will be ignored, leading to CSP directives not being properly applied to content. This vulnerability affects Firefox 69...

CVE-2019-11738

If a Content Security Policy CSP directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs will be allowed. This could allow for malicious JavaScript content to be run, bypassing CSP permissions. This vulnerability affects Firefox 6...

CVE-2019-11738

CVE-2019-11738 describes a Content Security Policy bypass in Firefox before 69 and Firefox ESR before 68.1: a hash-based CSP source that takes the empty string as input can allow execution of javascript: URIs, bypassing CSP permissions. Affected products: Firefox <69 and Firefox ESR

The vulnerability of the Content Security Policy component of the Firefox ESR browser allows attackers to execute cross-site scripting attacks.

The vulnerability of the Content Security Policy component in Firefox ESR is related to the lack of measures for sanitizing input data. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

Configuration Override

Overview Versions of helmet-csp before to 2.9.1 are vulnerable to a Configuration Override affecting the application's Content Security Policy CSP. The package's browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy. This allows an attacker to remove an...

CVE-2019-16216

Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server could upload files of certain types to mount a stored cross-site scripting attack on other logged-in users. On a Zulip server using the default local uploads backend, the attack...

Cross site scripting

Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server could upload files of certain types to mount a stored cross-site scripting attack on other logged-in users. On a Zulip server using the default local uploads backend, the attack...

Google Chrome CSP Bypass Vulnerability

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Google Chrome versions prior to 77.0.3865.75. A remote attacker can exploit the vulnerability with the help of a specially crafted website to bypass security restrictions and gain unauthorized acce...

Updated firefox packages fix security vulnerabilities

The updated packages fix several bugs and some security issues: Sandbox escape through Firefox Sync. CVE-2019-9812 Stored passwords in 'Saved Logins' can be copied without master password entry. CVE-2019-11733 Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1. CVE-2019-11735 File...

Cisco Content Security Virtual Appliance M380 IronPort Remote Cross Site Host Modification Exploit

// // // Disclaimer: // This or previous programs are for Educational purpose ONLY. Do not use it without permission. // The usual disclaimer applies, especially the fact that Todor Donev is not liable for any damages // caused by direct or indirect use of the information or functionality provide...

Cisco Content Security Virtual Appliance M380 IronPort Remote Cross Site Host Modification

// // // Disclaimer: // This or previous programs are for Educational purpose ONLY. Do not use it without permission. // The usual disclaimer applies, especially the fact that Todor Donev is not liable for any damages // caused by direct or indirect use of the information or functionality provide...

CVE-2019-12635

A vulnerability in the authorization module of Cisco Content Security Management Appliance SMA Software could allow an authenticated, remote attacker to gain out-of-scope access to email. The vulnerability exists because the affected software does not correctly implement role permission controls...

CVE-2019-12635

A vulnerability in the authorization module of Cisco Content Security Management Appliance SMA Software could allow an authenticated, remote attacker to gain out-of-scope access to email. The vulnerability exists because the affected software does not correctly implement role permission controls...

CVE-2019-12635

CVE-2019-12635 affects Cisco’s Content Security Management Appliance (SMA) software. The issue is in the authorization module where role permission controls are not correctly enforced, enabling an authenticated, remote attacker with a crafted/custom role to cause out-of-scope access to users’ ema...

CVE-2019-12635 Cisco Content Security Management Appliance Information Disclosure Vulnerability

A vulnerability in the authorization module of Cisco Content Security Management Appliance SMA Software could allow an authenticated, remote attacker to gain out-of-scope access to email. The vulnerability exists because the affected software does not correctly implement role permission controls...

Cisco Content Security Management Appliance Authorization Issues Vulnerability

Cisco Content Security Management Appliance SMA is a set of content security management equipment from Cisco Cisco. The appliance is mainly used to manage all policies, reports, audit information, etc. for e-mail and Web security devices. The Cisco Content Security Management Appliance is...

Ubuntu: Security Advisory (USN-4122-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mozilla Firefox ESR Security Advisories (MFSA2019-25, MFSA2019-27) - Mac OS X

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...