Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain

A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity...

PT-2020-12825 · Envoy +1 · Envoy +1

Name of the Vulnerable Software and Affected Versions: Istio versions 1.5.1 and earlier Envoy versions 1.14.1 and earlier Description: The issue concerns a data-leak problem where a TCP connection negotiated with SNI over HTTPS to .example.com can lead to a request for a domain configured...

The vulnerability of Firefox browser, related to security elements and the activation of functions from an unreliable controlled area, allows attackers to access confidential data.

The vulnerability of Firefox browsers is related to improper checking of the uploaded file, which can be exploited in a cross-domain scenario. Exploiting this vulnerability allows an attacker operating remotely to gain access to confidential data...

Arbitrary Code Execution

firefox is vulnerable to arbitrary code execution. The vulnerability exists as a flaw was found in the way Firefox handled certain JavaScript cross-domain requests. If malicious content generated a large number of cross-domain JavaScript requests, it could cause Firefox to execute arbitrary code...

Information Disclosure

cross-domain-local-storage-separately is vulnerable to information disclosure. The buildMessage function in xdLocalStorage.js allows the wildcard as the targetOrigin when calling the postMessage function on the iframe object, allowing any domains with iframe to accept requests from clients...

xdLocalStorage input validation error vulnerability (CNVD-2020-28469)

xdLocalStorage is a lightweight JavaScript library that supports cross-domain data storage . An input validation error vulnerability exists in xdLocalStorage, which stems from a function that does not perform any validation on the origin of a Web message. An attacker can exploit this vulnerabilit...

xdLocalStorage input validation error vulnerability (CNVD-2020-28471)

xdLocalStorage is a lightweight JavaScript library that supports cross-domain data storage . An input validation error vulnerability exists in xdLocalStorage. An attacker can exploit this vulnerability to obtain sensitive information...

xdLocalStorage input validation error vulnerability (CNVD-2020-28470)

xdLocalStorage is a lightweight JavaScript library that supports cross-domain data storage . An input validation error vulnerability exists in xdLocalStorage, which stems from a function that does not perform any validation on the origin of a Web message. An attacker can exploit this vulnerabilit...

xdLocalStorage Input Validation Error Vulnerability

xdLocalStorage is a lightweight JavaScript library that supports cross-domain data storage . An input validation error vulnerability exists in xdLocalStorage. An attacker can exploit this vulnerability to obtain sensitive information...

MTN Group: Insecure crossdomain.xml on https://vdc.mtnonline.com/

Hi, https://vdc.mtnonline.com/crossdomain.xml contains the following xml file: Impact This will make any one able to receive content from https://vdc.mtnonline.com/ , attacker can steal CSRF tokens and user PII. More information about this issue is available here:...

jquery: Cross-site scripting via cross-domain ajax requests

jQuery before 3.0.0 is vulnerable to Cross-site Scripting XSS attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed...

jquery: Cross-site scripting via cross-domain ajax requests

jQuery before 3.0.0 is vulnerable to Cross-site Scripting XSS attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed...

CVE-2020-4292

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 uses a cross-domain policy file that includes domains that should not be trusted which could disclose sensitive information. IBM X-Force ID: 176335...

CVE-2020-4292

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 uses a cross-domain policy file that includes domains that should not be trusted which could disclose sensitive information. IBM X-Force ID: 176335...

Cross site scripting

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 uses a cross-domain policy file that includes domains that should not be trusted which could disclose sensitive information. IBM X-Force ID: 176335...

CVE-2020-4292

CVE-2020-4292 affects IBM Security Information Queue (ISIQ) versions 1.0.0–1.0.4. The issue is an overly permissive cross-origin resource sharing (CORS) policy that can disclose sensitive information by including untrusted domains in the policy. The IBM bulletin confirms the root cause as the cro...

CVE-2020-4292

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 uses a cross-domain policy file that includes domains that should not be trusted which could disclose sensitive information. IBM X-Force ID: 176335...

CVE-2020-4292: Undefined Security Weakness

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 uses a cross-domain policy file that includes domains that should not be trusted which could disclose sensitive information. IBM X-Force ID: 176335...

Authentication Leak On Redirect With Reactor Netty HttpClient

Reactor Netty HttpClient, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects...

Microsoft Threat Protection stops attack sprawl and auto-heals enterprise assets with built-in intelligence and automation

Attackers will cross multiple domains like email, identity, endpoints, and applications to find the point of least resistance. Today’s defense solutions have been designed to protect, detect, and block threats for each domain separately, allowing attackers to exploit the seams and threshold...