Microsoft ASP.NET Core Information Disclosure Vulnerability

ASP.NET Core is a new open source and cross-platform framework for building modern cloud-based applications connected to the Internet such as web applications, Internet of Things IoT applications, and mobile back-end applications. Microsoft ASP.NET Core has an information disclosure vulnerability...

Mozilla Firefox Security Advisories (MFSA2017-24, MFSA2017-25) - Windows

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

Mozilla Firefox Security Advisories (MFSA2017-24, MFSA2017-25) - Mac OS X

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

Mozilla Firefox ESR Security Advisories (MFSA2017-24, MFSA2017-25) - Mac OS X

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

CVE-2017-11833

Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to determine the origin of all webpages in the affected browser, due to how Microsoft Edge handles cross-origin requests, aka "Microsoft Edge Information...

CVE-2017-11833

Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to determine the origin of all webpages in the affected browser, due to how Microsoft Edge handles cross-origin requests, aka "Microsoft Edge Information...

CVE-2017-7830

The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox 57, Firefox ESR 52.5, and Thunderbird 52.5...

Mozilla Firefox Cross-Origin URL Information Disclosure Vulnerability

Mozilla Firefox browser Firefox is a free, open source browser for Windows, Linux and MacOSX platforms. A cross-origin URL information disclosure vulnerability exists in Mozilla Firefox versions prior to 57.0. The vulnerability arises because the Resource Timing API incorrectly discloses navigati...

Security fix for the ALT Linux 10 package firefox-esr version 52.5.0-alt1

Nov. 15, 2017 Andrey Cherepanov 52.5.0-alt1 - New ESR version 52.5.0 - Fixes: + CVE-2017-7828 Use-after-free of PressShell while restyling layout + CVE-2017-7830 Cross-origin URL information leak through Resource + CVE-2017-7826 Memory safety bugs fixed in Firefox 57 and Firefox ESR...

UBUNTU-CVE-2017-7830

The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox 57, Firefox ESR 52.5, and Thunderbird 52.5...

Microsoft Edge Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists when Microsoft Edge improperly handles redirect requests. The vulnerability allows Microsoft Edge to bypass Cross-Origin Resource Sharing CORS redirect restrictions, and to follow redirect requests that should otherwise be ignored. An attacker who...

Microsoft Edge Information Disclosure Vulnerability

An information disclosure vulnerability exists in the way that Microsoft Edge handles cross-origin requests. An attacker who successfully exploited this vulnerability could determine the origin of all webpages in the affected browser. In a web-based attack scenario, an attacker could host a websi...

Microsoft Edge CORS Security Feature Bypass Vulnerability

Microsoft Edge is a popular browser. Microsoft Edge does not properly handle redirection requests, allowing remote attackers to exploit a vulnerability that could be exploited to construct malicious WEB pages that could be tricked into being parsed by users to bypass cross-origin resource sharing...

mozilla -- multiple vulnerabilities

Mozilla Foundation reports: CVE-2017-7828: Use-after-free of PressShell while restyling layout CVE-2017-7830: Cross-origin URL information leak through Resource Timing API CVE-2017-7831: Information disclosure of exposed properties on JavaScript proxy objects CVE-2017-7832: Domain spoofing throug...

Security vulnerabilities fixed in Firefox ESR 52.5 — Mozilla

A use-after-free vulnerability can occur when flushing and resizing layout because the PressShell object has been freed while still in use. This results in a potentially exploitable crash during these operations. The Resource Timing API incorrectly revealed navigations in cross-origin iframes. Th...

KB4048953: Windows 10 Version 1607 and Windows Server 2016 November 2017 Cumulative Update

The remote Windows host is missing security update 4048953. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass vulnerability exists when Microsoft Edge improperly handles redirect requests. The vulnerability allows Microsoft Edge to bypass Cross- Origin Resource...

tomcat: Vary header not added by CORS filter leading to cache poisoning

A vulnerability was discovered in Tomcat where the CORS Filter did not send a "Vary: Origin" HTTP header. This potentially allowed sensitive data to be leaked to other visitors through both client-side and server-side caches...

Google Chrome Information Disclosure Vulnerability (CNVD-2017-33593)

Google Chrome for Linux, Windows, Mac is an American Google Google company developed a Web browser based on Linux, Windows, Mac and Android platforms. An information disclosure vulnerability exists in Google Chrome for Mac, Windows, and Linux platforms. A remote attacker can extract pixel values...

Google Chrome Cross-Origin Content Download Vulnerability

Google Chrome for Android is a web browser based on the Android platform developed by Google USA. A security vulnerability exists in Google Chrome for Android. A remote attacker can exploit the vulnerability to download cross-origin content with the help of specially crafted HTML pages...

CVE-2017-5107

A timing attack in SVG rendering in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to extract pixel values from a cross-origin page being iframe'd via a crafted HTML page...