PT-2022-20566 · Undici · Undici

Name of the Vulnerable Software and Affected Versions: undici versions prior to 5.7.1 Description: The issue arises when authorization headers are cleared on cross-origin redirects, but cookie headers remain uncleared. This may lead to accidental leakage of cookies to a 3rd-party site or a...

The vulnerability in the implementation of the CORS (Cross-Origin Resource Sharing) mechanism in Firefox browsers, Firefox ESR, and the Thunderbird email client allows a perpetrator to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the CORS Cross-Origin Resource Sharing mechanism implementation in Firefox browsers, Firefox ESR, and the Thunderbird email client is related to the inclusion of functions from an unreliable controlled domain during the processing of the Access-Control-Allow-Credentials heade...

The vulnerability in the implementation of the CORS (Cross-Origin Resource Sharing) mechanism in Firefox browsers, Firefox ESR, and the Thunderbird email client allows a hacker to circumvent security restrictions.

The vulnerability of the CORS Cross-Origin Resource Sharing mechanism implementation in Firefox browsers, Firefox ESR, and the Thunderbird email client is related to the inclusion of functions from an unreliable controlled domain. Exploiting this vulnerability allows a malicious actor to bypass...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Thunderbird vulnerabilities (USN-5512-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5512-1 advisory. Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a...

Rocky Linux 8 : thunderbird (RLSA-2022:4887)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:4887 advisory. - Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100 and Firefox E...

Oracle Linux 9 : thunderbird (ELSA-2022-4892)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-4892 advisory. 91.10.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Reference oracle-indexhtml within Requires...

Mozilla Firefox ESR Security Advisory (MFSA2022-21) - Windows

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

Mozilla Thunderbird Security Advisory (MFSA2022-22) - Windows

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

Oracle Linux 9 : firefox (ELSA-2022-4590)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-4590 advisory. 91.9.0-1.0.1 - Replaced upstream package with oracle-indexhtml Orabug: 33802044 - Add firefox-oracle-default-prefs.js and remove the corresponding Red...

Oracle Linux 9 : firefox (ELSA-2022-4873)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-4873 advisory. 91.10.0-1.0.1 - Replaced upstream package with oracle-indexhtml Orabug: 33802044 - Add firefox-oracle-default-prefs.js and remove the corresponding Red...

Mozilla Firefox Security Advisory (MFSA2022-20) - Windows

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

Oracle Linux 9 : thunderbird (ELSA-2022-4589)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-4589 advisory. 91.9.0-3.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Reference oracle-indexhtml within Requires Orabu...

Fisheye: Multiple Servlet Filter Vulnerabilities

Multiple Servlet Filter vulnerabilities have been fixed in Fisheye. These vulnerabilities also affect other Atlassian products. For more information, refer to Atlassian's security...

UBUNTU-CVE-2022-34477

The MediaError message property should be consistent to avoid leaking information about cross-origin resources; however for a same-site cross-origin resource, the message could have leaked information enabling XS-Leaks attacks. This vulnerability affects Firefox 102...

Information Disclosure

firefox is vulnerable to information disclosure. The vulnerability exists because the MediaError message property leaked information on cross-origin same-site pages...

The vulnerability of the COOP component of the Google Chrome browser allows a hacker to disclose protected information.

The vulnerability of the COOP component of the Google Chrome browser is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to disclose protected information through a specially created web page...

CVE-2022-32154

Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and...

Design/Logic Flaw

Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and...

CVE-2022-32154 Risky commands warnings in Splunk Enterprise Dashboards

Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and...

CVE-2022-32154

Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and...