Mozilla Firefox ESR Security Advisories (MFSA2019-09, MFSA2019-14) - Windows

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

UBUNTU-CVE-2019-9817

Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird 60.7, Firefox 67, and Firefox ESR 60.7...

Security fix for the ALT Linux 10 package thunderbird version 60.7.0-alt1

May 20, 2019 Andrey Cherepanov 60.7.0-alt1 - New version 60.7.0. - Fixed: + CVE-2019-9815 Disable hyperthreading on content JavaScript threads on macOS + CVE-2019-9816 Type confusion with object groups and UnboxedObjects + CVE-2019-9817 Stealing of cross-domain images using canvas + CVE-2019-9818...

Google Chrome Blink System Unauthorized Access Vulnerability (CNVD-2019-23115)

Google Chrome is a Web browser from Google, a U.S. company. Blink is a browser layout engine rendering engine jointly developed by Google and Norway's OperaSoftware. An unauthorized access vulnerability exists in Blink in versions of Google Chrome prior to 74.0.3729.108. An attacker can exploit...

Google Chrome integer overflow vulnerability (CNVD-2019-23344)

Google Chrome is a web browser from Google, an American company. An integer overflow vulnerability exists in the Download Manager in versions prior to Google Chrome 74.0.3729.108. An attacker can exploit this vulnerability by tricking a user into visiting a specially crafted website to bypass the...

CVE-2019-0678

An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain.In a web-based attack scenario, an attacker could host a website that is used t...

Privilege escalation

An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain.In a web-based attack scenario, an attacker could host a website that is used t...

CVE-2019-0678

CVE-2019-0678 is described in connected sources as an elevation of privilege in Microsoft Edge caused by failure to properly enforce cross-domain policies, allowing a remote attacker to access information from one domain and inject it into another. The CNVD entry explicitly notes Edge’s cross-dom...

CVE-2019-0678

An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain.In a web-based attack scenario, an attacker could host a website that is used t...

Microsoft Windows Multiple Vulnerabilities (KB4489899)

This host is missing a critical security update according to Microsoft KB4489899 Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progra...

Microsoft Edge Remote Elevation of Privilege Vulnerability (CNVD-2019-07331)

Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. A privilege extraction vulnerability exists in Microsoft Edge, which stems from the program failing to properly enforce cross-domain policies. A remote attacker could exploit the...

Microsoft Browsers Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of different origins. The vulnerability allows Microsoft browsers to bypass Same-Site cookie restrictions, and to allow requests that should otherwise be ignored. An attacker who successfully exploit...

Microsoft Edge Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain. In a web-based attack scenario, an attacker could host a website that is used ...

Severe Flaw Disclosed In StackStorm DevOps Automation Software

A security researcher has discovered a severe vulnerability in the popular, open source event-driven platform StackStorm that could allow remote attackers to trick developers into unknowingly execute arbitrary commands on targeted services. StackStorm, aka "IFTTT for Ops," is a powerful...

StackStorm Cross-Site Scripting Vulnerability

StackStorm is an event-driven automation platform. The platform is used for automated remediation, security response, troubleshooting, and program deployment functions.Web UI is one of the web-based user graphical interfaces. A security vulnerability exists in st2web in StackStorm Web UI versions...

rt -- XSS via jQuery

BestPractical reports: The version of jQuery used in RT 4.2 and 4.4 has a Cross-site Scripting XSS vulnerability when using cross-domain Ajax requests. This vulnerability is assigned CVE-2015-9251. RT does not use this jQuery feature so it is not directly vulnerable. jQuery version 1.12 no longer...

GHSA-QMV4-JGP7-MF68 Sails before 0.12.7 vulnerable to Broken CORS

Affected versions of sails have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This may allow an attacker to make AJAX requests to vulnerable hosts through cross-site scripting or a malicious HTML...

Google Chrome Information Disclosure Vulnerability (CNVD-2019-03595)

Google Chrome is a web browser developed by Google Google.Service Workers is a component that provides offline support for web applications. A security vulnerability exists in Service Workers in Google Chrome versions prior to 66.0.3359.117. A remote attacker can exploit the vulnerability to...

Microsoft .NET Framework and .NET Core Information Disclosure Vulnerability

NET Framework and .NET Core are both products of Microsoft Corporation.Microsoft .NET Framework is a comprehensive and consistent programming model and development platform for building applications for Windows, Windows Store, Windows Server, and Microsoft Azure. NET Framework is a comprehensive...

Google Chrome Service Worker Information Disclosure Vulnerability

Google Chrome is a web browser developed by Google Google.Service Workers is a component that provides offline support for web applications. A security vulnerability exists in Service Worker in versions of Google Chrome prior to 66.0.3359.106, which stems from the program's lack of cross-domain...