Cross site scripting

The default Flash Cross Domain policies in ownCloud before 5.0.15 and 6.x before 6.0.2 allows remote attackers to access user files via unspecified vectors...

CVE-2014-2049

The default Flash Cross Domain policies in ownCloud before 5.0.15 and 6.x before 6.0.2 allows remote attackers to access user files via unspecified vectors...

CVE-2014-2049

The CVE-2014-2049 issue affects ownCloud Server before version 5.0.15 and before 6.0.2, due to insecure default Flash Cross Domain policies. Root cause: insecure cross-domain configuration in Flash policies. Impact: remote attackers could access user files via unspecified vectors. Public advisori...

CVE-2014-2049

The default Flash Cross Domain policies in ownCloud before 5.0.15 and 6.x before 6.0.2 allows remote attackers to access user files via unspecified vectors...

CVE-2014-2049: Undefined Security Weakness

The default Flash Cross Domain policies in ownCloud before 5.0.15 and 6.x before 6.0.2 allows remote attackers to access user files via unspecified vectors...

PT-2014-4451

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 5.0.15 ownCloud versions 6.x prior to 6.0.2 Description The issue allows remote attackers to access user files due to the default Flash Cross Domain policies. Recommendations For ownCloud versions prior to 5.0.15,...

Microsoft XML Core Services DTD Cross-Domain Scripting (MS08-069) - Ver2 (CVE-2008-4029)

MSXML is an application for processing Extensible Stylesheet Language Transformation in an XML file that allows programmers to create high-performance XML-based applications. An information disclosure vulnerability has been reported in Microsoft XML Core Services MSXML. The vulnerability is due t...

CVE-2014-0293

Microsoft Internet Explorer 9 through 11 allows remote attackers to read content from a different 1 domain or 2 zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."...

CVE-2014-0293

CVE-2014-0293 affects Microsoft Internet Explorer 9–11. The vulnerability allows a remote attacker to read content from a different domain or security zone when a user visits a crafted web page, enabling cross-domain information disclosure. The underlying issue is described as cross-domain inform...

CVE-2014-0293: Exposure of Sensitive Information to an Unauthorized Actor

Microsoft Internet Explorer 9 through 11 allows remote attackers to read content from a different 1 domain or 2 zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."...

Microsoft Window XML Core Services Information Disclosure Vulnerability (2916036)

This host is missing an important security update according to Microsoft Bulletin MS14-005. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Web Site Client Access Policy File Detection

The remote web server contains a client access policy file. This is a simple XML file used by Microsoft Silverlight to allow access to services that reside outside the exact web domain from which a Silverlight control originated. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Microsoft Internet Explorer CVE-2014-0293 Cross Domain Information Disclosure Vulnerability

Description Microsoft Internet Explorer is prone to a cross-domain information-disclosure vulnerability. An attacker can exploit this issue to view content from a browser window in another domain or security zone. This may allow the attacker to obtain sensitive information or aid in further...

Microsoft XML Core Services Information Disclosure (MS14-005; CVE-2014-0266)

An information-disclosure vulnerability has been reported in Microsoft XML Core Services. The vulnerability is caused when Internet Explorer does not properly enforce cross-domain policies, allowing an attacker to access content from different domains. An attacker could exploit the vulnerability ...

HackerOne: Information disclosure (reset password token) and changing the user's password

The user gets an e-mail with password recovery link, which includes reset password token. The user clicks this link and is expected to enter a new password twice. Before entering the password the user clicks a link to a picture https://xkcd.com/936/. When this happens, cross-domain referer leakag...

Mac OS X Safari file:// Redirection Sandbox Escape

Versions of Safari before 8.0.6, 7.1.6, and 6.2.6 are vulnerable to a "state management issue" that allows a browser window to be navigated to a file:// URL. By dropping and loading a malicious .webarchive file, an attacker can read arbitrary files, inject cross-domain Javascript, and silently...

[Watcher] passive Web-security scanner

Watcher is a runtime passive-analysis tool for HTTP-based Web applications. Being passive means it won't damage production systems, it's completely safe to use in Cloud computing, shared hosting, and dedicated hosting environments. Watcher detects Web-application security issues as well as...

Firefox < 26.0 Multiple Vulnerabilities (Mac OS X)

The installed version of Firefox is earlier than 26.0 and is, therefore, potentially affected by multiple vulnerabilities : - Memory issues exist in the browser engine that could result in a denial of service or arbitrary code execution. CVE-2013-5609, CVE-2013-5610 - An issue exists where the...

Mozilla Thunderbird < 24.2 Multiple Vulnerabilities

The installed version of Thunderbird is earlier than 24.2 and is, therefore, potentially affected the following vulnerabilities: - Memory issues exist in the browser engine that could result in a denial of service or arbitrary code execution. CVE-2013-5609, CVE-2013-5610 - Two use-after-free...

JPEG information leak — Mozilla

Google security researcher Michal Zalewski reported issues with JPEG format image processing with Start Of Scan SOS and Define Huffman Table DHT markers in the libjpeg library. This could allow for the possible reading of arbitrary memory content as well as cross-domain image theft...