CVE-2020-1056

CVE-2020-1056: Elevation of Privilege affecting Microsoft Edge. Root cause described as improper enforcement of cross-domain policies, enabling an attacker to access information from one domain and inject it into another domain. The connected Microsoft KB entries reference Edge-related security u...

CVE-2020-1056 Microsoft Edge Elevation of Privilege Vulnerability

...

Microsoft Edge Elevation of Privilege Vulnerability (CNVD-2020-61595)

Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. An elevation of privilege vulnerability exists in Microsoft Edge that stems from the program failing to properly enforce cross-domain policies. An attacker could exploit the vulnerability...

DEBIAN-CVE-2020-12826

A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2. Because execid in include/linux/sched.h is only 32 bits, an integer overflow can interfere with a donotifyparent protection mechanism. A child process can send an arbitrary signal to a parent...

UBUNTU-CVE-2020-12826

A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2. Because execid in include/linux/sched.h is only 32 bits, an integer overflow can interfere with a donotifyparent protection mechanism. A child process can send an arbitrary signal to a parent...

Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain

A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity...

Microsoft Edge Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain. In a web-based attack scenario, an attacker could host a website that is used ...

Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain

A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity...

Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain

A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity...

Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain

A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity...

Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain

A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity...

PT-2020-12825 · Envoy +1 · Envoy +1

Name of the Vulnerable Software and Affected Versions: Istio versions 1.5.1 and earlier Envoy versions 1.14.1 and earlier Description: The issue concerns a data-leak problem where a TCP connection negotiated with SNI over HTTPS to .example.com can lead to a request for a domain configured...

The vulnerability of Firefox browser, related to security elements and the activation of functions from an unreliable controlled area, allows attackers to access confidential data.

The vulnerability of Firefox browsers is related to improper checking of the uploaded file, which can be exploited in a cross-domain scenario. Exploiting this vulnerability allows an attacker operating remotely to gain access to confidential data...

Arbitrary Code Execution

firefox is vulnerable to arbitrary code execution. The vulnerability exists as a flaw was found in the way Firefox handled certain JavaScript cross-domain requests. If malicious content generated a large number of cross-domain JavaScript requests, it could cause Firefox to execute arbitrary code...

Information Disclosure

cross-domain-local-storage-separately is vulnerable to information disclosure. The buildMessage function in xdLocalStorage.js allows the wildcard as the targetOrigin when calling the postMessage function on the iframe object, allowing any domains with iframe to accept requests from clients...

xdLocalStorage input validation error vulnerability (CNVD-2020-28469)

xdLocalStorage is a lightweight JavaScript library that supports cross-domain data storage . An input validation error vulnerability exists in xdLocalStorage, which stems from a function that does not perform any validation on the origin of a Web message. An attacker can exploit this vulnerabilit...

xdLocalStorage input validation error vulnerability (CNVD-2020-28470)

xdLocalStorage is a lightweight JavaScript library that supports cross-domain data storage . An input validation error vulnerability exists in xdLocalStorage, which stems from a function that does not perform any validation on the origin of a Web message. An attacker can exploit this vulnerabilit...

xdLocalStorage input validation error vulnerability (CNVD-2020-28471)

xdLocalStorage is a lightweight JavaScript library that supports cross-domain data storage . An input validation error vulnerability exists in xdLocalStorage. An attacker can exploit this vulnerability to obtain sensitive information...

xdLocalStorage Input Validation Error Vulnerability

xdLocalStorage is a lightweight JavaScript library that supports cross-domain data storage . An input validation error vulnerability exists in xdLocalStorage. An attacker can exploit this vulnerability to obtain sensitive information...

MTN Group: Insecure crossdomain.xml on https://vdc.mtnonline.com/

Hi, https://vdc.mtnonline.com/crossdomain.xml contains the following xml file: Impact This will make any one able to receive content from https://vdc.mtnonline.com/ , attacker can steal CSRF tokens and user PII. More information about this issue is available here:...