5028 matches found
CVE-2020-6501
Insufficient policy enforcement in CSP in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML page...
CVE-2020-6501
CVE-2020-6501 affects Google Chrome versions prior to 80.0.3987.87, due to insufficient policy enforcement in CSP, which could allow a remote attacker to bypass the content security policy via a crafted HTML page. Impact: CSP bypass. Mitigation: update Chrome to 80.0.3987.87 or later. Connected d...
CVE-2020-12391
Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. This vulnerability affects Firefox 76...
CVE-2020-11069
In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-site request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to...
CVE-2020-11069
In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-site request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to...
Cross site request forgery (csrf)
In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-site request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to...
Backend Same-Site Request Forgery in TYPO3 CMS
Meta CVSS v3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C CWE-352 CWE-346 Problem It has been discovered that backend user interface and install tool are vulnerable to same-origin request forgery. A backend user can be tricked into interacting with a malicious resource an attacker...
GHSA-PQG8-CRX9-G8M4 Backend Same-Site Request Forgery in TYPO3 CMS
Meta CVSS v3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C CWE-352 CWE-346 Problem It has been discovered that backend user interface and install tool are vulnerable to same-origin request forgery. A backend user can be tricked into interacting with a malicious resource an attacker...
CVE-2020-11069 Cross-Site Request Forgery in TYPO3 CMS
In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-site request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to...
U.S. Dept Of Defense: RXSS - https://████████/
Hello All I Found RXSS in your OWN Website Steps To Reproduce Go to Those Links. https://██████/A'onerror=%22alert%601%60%22testabcd/ Browsers I test them on Firefox and Google Chrome. Fix:- Filter input on arrival Encode data on output Use appropriate response headers Content Security Policy...
Security update for cacti, cacti-spine (moderate)
openSUSE Security Update: Security update for cacti, cacti-spine Announcement ID: openSUSE-SU-2020:0654-1 Rating: moderate References: 1163749 Cross-References: CVE-2020-7106 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 An updat...
UBUNTU-CVE-2020-12391
Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. This vulnerability affects Firefox 76...
CVE-2020-6813
When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker to inject arbitrary styles, bypassing the intent of the Content Security Policy. This vulnerability affects Firefox 74...
chromium-browser: Insufficient policy enforcement in trusted types
Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security policy via a crafted HTML page...
chromium-browser: Insufficient policy enforcement in trusted types
Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security policy via a crafted HTML page...
Stored XSS in Confluence Server via text/rdf
h3. Issue Summary There is a stored XSS in file upload functionality of Confluence Server 7.3.3. This XSS triggers only in Firefox. Bug Bounty An authenticated attacker can upload specially crafted attachment and achieve stored XSS. h3. Steps to Reproduce Go to any Confluence page Attach xss.txt...
CVE-2020-6445
Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security policy via a crafted HTML page...
CVE-2020-6446
Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security policy via a crafted HTML page...