CVE-2016-2816

Mozilla Firefox before 46.0 allows remote attackers to bypass the Content Security Policy CSP protection mechanism via the multipart/x-mixed-replace content type...

firefox: multiple issues

CVE-2016-2804: Gary Kwong, Christian Holler, Andrew McCreight, Boris Zbarsky, and Steve Fink reported memory safety problems and crashes that are fixed in Firefox 46. - CVE-2016-2805: Christian Holler reported a memory safety problem that is fixed in Firefox ESR 38.8. - CVE-2016-2806: Gary Kwong,...

Firefox < 46 Multiple Vulnerabilities (Mac OS X)

The version of Firefox installed on the remote Mac OS X host is prior to 46. It is, therefore, affected by multiple vulnerabilities : - Multiple memory corruption issues exist that allow an attacker to corrupt memory, resulting in the execution of arbitrary code. CVE-2016-2804, CVE-2016-2806,...

Mozilla Firefox Security Bypass Vulnerability (CNVD-2016-02674)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in versions of Mozilla Firefox prior to 46, which stems from a failure to properly apply Content Security Policy CSP to Web content sent with the...

USN-2934-1 thunderbird vulnerabilities

Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel Holbert, Jesse Ruderman, and Randell Jesup discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denia...

USN-2936-1 firefox vulnerabilities

Christian Holler, Tyson Smith, Phil Ringalda, Gary Kwong, Jesse Ruderman, Mats Palmgren, Carsten Book, Boris Zbarsky, David Bolter, Randell Jesup, Andrew McCreight, and Steve Fink discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website...

UBUNTU-CVE-2016-2816

Mozilla Firefox before 46.0 allows remote attackers to bypass the Content Security Policy CSP protection mechanism via the multipart/x-mixed-replace content type...

GitLab: Persistent XSS on public project page

Details A project admin can set up a custom issue tracker integration. This setting misses a check to make sure that it's a real URL and, thus, can use the javascript handler to execute arbitrary Javascript. Browsers use this handler to execute inline Javascript. This can lead to an account take...

The vulnerability of the Mac OS X operating system, which allows a perpetrator to obtain confidential information

The vulnerability of the Content Security Policy implementation in the Messages component of the Mac OS X operating system is related to the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain confidential information...

The vulnerability of the Firefox browser allows a perpetrator to obtain confidential information or circumvent existing access restrictions policies.

The vulnerability of Firefox browsers is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to bypass existing access restrictions or obtain confidential information by accessing the Content Security Policy violation report...

CVE-2016-1764

The Content Security Policy CSP implementation in Messages in Apple OS X before 10.11.4 allows remote attackers to obtain sensitive information via a javascript: URL...

CVE-2016-1764

The Content Security Policy CSP implementation in Messages in Apple OS X before 10.11.4 allows remote attackers to obtain sensitive information via a javascript: URL...

Code injection

The Content Security Policy CSP implementation in Messages in Apple OS X before 10.11.4 allows remote attackers to obtain sensitive information via a javascript: URL...

CVE-2016-1764

The Content Security Policy CSP implementation in Messages in Apple OS X before 10.11.4 allows remote attackers to obtain sensitive information via a javascript: URL...

CVE-2016-1764

Summary (CVE-2016-1764): In OS X El Capitan prior to 10.11.4, the Content Security Policy (CSP) implementation in the Messages component allowed remote attackers to disclose sensitive information via a javascript: URL. The issue stems from how JavaScript links were processed by Messages. Impact: ...

Cisco ASA 5500 Devices DoS Vulnerability (cisco-sa-20160309-csc)

Cisco ASA 5500 devices are prone to a denial of service DoS vulnerability. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...

The vulnerability of Google Chrome browser allows a perpetrator to obtain confidential information.

The vulnerability of the Content Security Policy CSP implementation in Google Chrome’s Blink engine is related to the lack of protection for service data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain confidential information about visited web pages by...

Mozilla: Local file overwriting and potential privilege escalation through CSP reports (MFSA 2016-17)

The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not prevent use of a non-HTTP report-uri for a Content Security Policy CSP violation report, which allows remote attackers to cause a denial of service data...

DEBIAN-CVE-2016-1955

Mozilla Firefox before 45.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy CSP violation report that contains path information associated with an IFRAME element...

CVE-2016-1955

Mozilla Firefox before 45.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy CSP violation report that contains path information associated with an IFRAME element...