5499 matches found
Design/Logic Flaw
By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject stylesheets and bypass Content Security Policy CSP. This vulnerability affects Firefox 63...
CVE-2018-12398
By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject stylesheets and bypass Content Security Policy CSP. This vulnerability affects Firefox 63...
CVE-2018-12398
By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject stylesheets and bypass Content Security Policy CSP. This vulnerability affects Firefox 63...
Permissive Content Security Policy Detected
Content Security Policy CSP is a web security standard that helps to mitigate attacks like cross-site scripting XSS, clickjacking or mixed content issues. CSP provides mechanisms to websites to restrict content that browsers will be allowed to load. One or several permissive directives have been...
Deprecated Content Security Policy
Content Security Policy CSP is a web security standard that helps to mitigate attacks like cross-site scripting XSS, clickjacking or mixed content issues. CSP provides mechanisms to websites to restrict content that browsers will be allowed to load. X-Content-Security-Policy and X-Webkit-CSP HTTP...
Missing Content Security Policy
Content Security Policy CSP is a web security standard that helps to mitigate attacks like cross-site scripting XSS, clickjacking or mixed content issues. CSP provides mechanisms to websites to restrict content that browsers will be allowed to load. No CSP header has been detected on this host...
Detecting bots using Content Security Policy (CSP) headers
Bots are noisy, like really. And dangerous as well, especially if they can do crawling and increase usage by legitimate operations like items catalog retrieve in the case of e-commerce. I mean, we have a lot of reasons to do not like bots and count this problem as a cybersecurity threat, which...
Cross-site Scripting (XSS)
cloudforms is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as a flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input. An attacker could use this flaw to execute...
Google Chrome Blink Security Bypass Vulnerability (CNVD-2019-03542)
Google Chrome is a web browser developed by Google Inc. Blink is a browser layout engine rendering engine jointly developed by Google Inc. and Opera Software of Norway. A security vulnerability exists in Blink in versions of Google Chrome prior to 66.0.3359.117, which stems from the program's...
CVE-2018-6114
Incorrect enforcement of CSP for tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content security policy via a crafted HTML page...
CVE-2018-6114
Incorrect enforcement of CSP for tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content security policy via a crafted HTML page...
CVE-2018-6114
Incorrect enforcement of CSP for tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content security policy via a crafted HTML page...
UBUNTU-CVE-2018-6114
Incorrect enforcement of CSP for tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content security policy via a crafted HTML page...
Design/Logic Flaw
Incorrect enforcement of CSP for tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content security policy via a crafted HTML page...
CVE-2018-6114
Removed by vendor...
CVE-2018-6114
CVE-2018-6114: A vulnerability in Chromium/Blink allowed bypass of Content Security Policy via CSP enforcement failure for tags. Affected products include Google Chrome and Chromium (Blink engine). Root cause is CSP bypass in the rendering pipeline, enabling remote HTML crafted pages to bypass C...
Chat Anywhere extension for Chrome cross-site scripting vulnerability
Chat Anywhere extension for Chrome is an online chat plugin for use in Google Chrome. A cross-site scripting vulnerability exists in the Chat Anywhere extension for Chrome version 2.4.0, which stems from the danmuWrapper DIV element in the chatbox-only\danmu.js file being out of the scope of the...
Code injection
The Chat Anywhere extension 2.4.0 for Chrome allows XSS via crafted use of in a message, because a danmuWrapper DIV element in chatbox-only\danmu.js is outside the scope of a Content Security Policy CSP...
CVE-2018-20524
The Chat Anywhere extension 2.4.0 for Chrome allows XSS via crafted use of in a message, because a danmuWrapper DIV element in chatbox-only\danmu.js is outside the scope of a Content Security Policy CSP...
CVE-2018-20524
Affected software: Chat Anywhere extension for Chrome, version 2.4.0. Vulnerability details: A cross-site scripting (XSS) flaw exists because the danmuWrapper DIV in chatbox-only\danmu.js lies outside the scope of the extension’s Content Security Policy (CSP). This can be exploited via crafted me...