5028 matches found
The vulnerability of the Content Security Policy implementation in Google Chrome’s web browser, related to improper authorization, allows a perpetrator to compromise data integrity.
The vulnerability of the Content Security Policy mechanism in the Google Chrome web browser is related to insufficient implementation of policies. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially crafted HTML page...
PT-2021-23860 · Mozilla +2 · Firefox +2
Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 94 Description: The issue allows a website to potentially steal authentication tokens by tricking a user into copying and pasting an image link that contains the token. This can happen when an image triggers...
GHSA-4P3X-8QW9-24W9 Authenticated Stored XSS in shopware/shopware
Impact Authenticated Stored XSS in Administration Patches Use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html Workarounds If you cannot use the security plugin, add the following config to your .htaccess file Header set Content-Security-Policy...
Authenticated Stored XSS in shopware/shopware
Impact Authenticated Stored XSS in Administration Patches Use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html Workarounds If you cannot use the security plugin, add the following config to your .htaccess file Header set Content-Security-Policy...
NewStart CGSL CORE 5.05 / MAIN 5.05 : firefox Multiple Vulnerabilities (NS-SA-2021-0178)
The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has firefox packages installed that are affected by multiple vulnerabilities: - Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP...
NewStart CGSL CORE 5.04 / MAIN 5.04 : firefox Multiple Vulnerabilities (NS-SA-2021-0094)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has firefox packages installed that are affected by multiple vulnerabilities: - When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted...
NewStart CGSL CORE 5.04 / MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2021-0094)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has thunderbird packages installed that are affected by multiple vulnerabilities: - When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have...
The vulnerability of the Content Security Policy component in the Google Chrome web browser, related to improper authorization, allows attackers to compromise data integrity.
The vulnerability of the Content Security Policy component in the Google Chrome web browser is related to insufficient implementation of policies. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially crafted HTML page...
NewStart CGSL CORE 5.05 / MAIN 5.05 : thunderbird Multiple Vulnerabilities (NS-SA-2021-0177)
The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has thunderbird packages installed that are affected by multiple vulnerabilities: - Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted...
The vulnerability of the Content Security Policy component in the Google Chrome web browser, related to improper authorization, allows attackers to compromise data integrity.
The vulnerability of the Content Security Policy component in the Google Chrome web browser is related to insufficient implementation of policies. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially crafted HTML page...
CVE-2021-41178
Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker able to download arbitrary SVG images from the host system, including user provided files. This could also be leveraged into a XSS/phishi...
CVE-2021-41178
Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker able to download arbitrary SVG images from the host system, including user provided files. This could also be leveraged into a XSS/phishi...
Design/Logic Flaw
Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker able to download arbitrary SVG images from the host system, including user provided files. This could also be leveraged into a XSS/phishi...
CVE-2021-41178 File Traversal affecting SVG files on Nextcloud Server
Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker able to download arbitrary SVG images from the host system, including user provided files. This could also be leveraged into a XSS/phishi...
CVE-2021-39221
Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Contacts application prior to version 4.0.3 was vulnerable to a stored Cross-Site Scripting XSS vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due t...
CVE-2021-39221
Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Contacts application prior to version 4.0.3 was vulnerable to a stored Cross-Site Scripting XSS vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due t...
Cross site scripting
Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Contacts application prior to version 4.0.3 was vulnerable to a stored Cross-Site Scripting XSS vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due t...
CVE-2021-39221 XSS in Contacts
Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Contacts application prior to version 4.0.3 was vulnerable to a stored Cross-Site Scripting XSS vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due t...
Rocket.Chat: Content-Security Policy bypass with File Uploads
The default Content-Security Policy CSP in Rocket.Chat versions 4.0.3 and 3.18.2 was bypassed by uploading a JavaScript file through the file upload feature. This file could then be included in the web application, allowing the execution of arbitrary scripts...
