CVE-2015-0070: Exposure of Sensitive Information to an Unauthorized Actor

Microsoft Internet Explorer 6 through 11 allows remote attackers to read content from a different 1 domain or 2 zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."...

Microsoft Internet Explorer CVE-2015-0070 Cross Domain Information Disclosure Vulnerability

Description Microsoft Internet Explorer is prone to a cross-domain information-disclosure vulnerability. An attacker can exploit this issue to view content from a browser window in another domain or security zone. This may allow the attacker to obtain sensitive information or aid in further...

PT-2015-4445

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6 through 11 Description An information disclosure issue exists due to improper enforcement of cross-domain policies by Internet Explorer, potentially allowing attackers to access information from another...

PT-2015-4446

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 9 through 11 Description The issue allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML. This is achieved through vectors involving an IFRAME element that trigger...

Google Chrome for Android Cross Domain Bypass Vulnerability

Google Chrome for Android is an Android-based browser. Google Chrome for Android V8 bundles have cross-domain bypass that allows attackers to build malicious WEB pages, trick users into parsing and executing arbitrary code, etc...

Apple TV stylesheet cross-domain loading vulnerability

Apple TV is Apple's way of allowing photos, videos and music from PCs and iPods to be transmitted wirelessly to a TV in high definition. A cross-domain loading vulnerability exists in the Apple TV stylesheet, which can be exploited by attackers to obtain sensitive data...

Android browser cross-domain data theft, and the Intent of the Scheme to attack-vulnerability warning-the black bar safety net

We next want to introduce this vulnerability, which affects versions of Android 4. 4 The following comes with the browser and some other specific Android browser, which allowed hackers to read the sqlite format of the cookie database file, thereby stealing cookies. Along with this problem, we hav...

DEBIAN-CVE-2014-9277

The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing in a PHP format request, which causes the string length...

CVE-2014-9277

The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing in a PHP format request, which causes the string length...

Design/Logic Flaw

The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing in a PHP format request, which causes the string length...

CVE-2014-9277

The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing in a PHP format request, which causes the string length...

Debian DSA-3100-1 : mediawiki - security update

A flaw was discovered in mediawiki, a wiki engine: cross-domain-policy mangling allows an article editor to inject code into API consumers that deserialize PHP representations of the page from the API. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

[SECURITY] [DSA 3100-1] mediawiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3100-1 [email protected] http://www.debian.org/security/ Sebastien Delafond December 12, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3100-1] mediawiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3100-1 [email protected] http://www.debian.org/security/ Sebastien Delafond December 12, 2014 http://www.debian.org/security/faq -...

DSA-3100-1 mediawiki - security update

Bulletin has no description...

Debian Security Advisory DSA 3100-1 (mediawiki - security update)

A flaw was discovered in mediawiki, a wiki engine: cross-domain-policy mangling allows an article editor to inject code into API consumers that deserialize PHP representations of the page from the API. OpenVAS Vulnerability Test $Id: deb3100.nasl 6663 2017-07-11 09:58:05Z teissa $ Auto-generated...

Lax Crossdomain Policy Puts Yahoo Mail At Risk

Yahoo has made strides in battening down its security in the last 12 months, most publicly with its decision to enable end-to-end encryption for its email service, turn on SSL by default, and encrypt links between its data centers. There are still some darkened corners of its infrastructure,...

Debian: Security Advisory (DSA-3100-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

HDFLVPlayer 2.2 and previous

HDFLVPlayer versions 2.2 and all previous Email exploit Version 2.3 Fixed SQL injection in download.php file.https://www.apptha.com/category/extension/Joomla/HD-FLV-Player Version 2.2 Resolved cross domain issue in download.php & email.php files...

PingFederate 6.10.1 SP Endpoints Open Redirect

CVE-2014-8489 Ping Identity Corporation "PingFederate 6.10.1 SP Endpoints" Dest Redirect Privilege Escalation Security Vulnerability Exploit Title: "Ping Identity Corporation" "PingFederate 6.10.1 SP Endpoints" Dest Redirect Privilege Escalation Security Vulnerability Product: PingFederate 6.10.1...