PT-2015-7532

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2 Description The issue concerns the default Flash cross-domain policy, specifically the crossdomain.xml file, which does not properly restrict cross-domain access. This allows remote attackers to conduct...

CVE-2015-7369: Improper Access Control

The default Flash cross-domain policy crossdomain.xml in Revive Adserver before 3.2.2 does not restrict access cross domain access, which allows remote attackers to conduct cross domain attacks via unspecified vectors...

Imgur: Crossdomain.xml settings on api.imgur.com too open

The crossdomain.xml file hosted at http://api.imgur.com/crossdomain.xml was too open. This allowed SWF files to make HTTP requests and see it's response. If this was not changed, then attacker.com can embed a SWF on attacker.com/example.html that makes an HTTP request to http://api.imgur.com/. Th...

Mail.ru: Same Origin Policy bypass

Hi, After small investigation I've probably found something that can be exploited to bypass Same Origin Policy on mail.ru services specially your main domain and e.mail.ru. First of all - let's take a look about your crossdomain.xml both for mail.ru and e.mail.ru: After time spent on searching...

Vimeo: Misconfigured crossdomain.xml - vimeo.com

An overly permissive crossdomain.xml file on a domain that serves sensitive content is a major security risk. It exposes the domain hosting the improperly configured crossomain.xml file to information disclosure and request forgery. Attackers cannot only forge requests, they can read responses...

CVE-2014-2227

The CVE-2014-2227 issue affects Ubiquiti Networks UniFi Video (AirVision Controller) before 3.0.1, where the default crossdomain.xml (Flash cross-domain policy) fails to restrict access, allowing remote attackers to bypass the Same Origin Policy via a crafted SWF file. This enables attacks such a...

CVE-2014-2227: Undefined Security Weakness

The default Flash cross-domain policy crossdomain.xml in Ubiquiti Networks UniFi Video formerly AirVision aka AirVision Controller before 3.0.1 does not restrict access to the application, which allows remote attackers to bypass the Same Origin Policy via a crafted SWF file...

Ubiquiti AirVision Controller 2.1.3 Weak Settings

----------- Vendor: ----------- Ubiquiti Networks http://www.ubnt.com/ ---------------------------------------------- Affected Products/Versions: ---------------------------------------------- AirVision Controller v2.1.3 Note: Previous versions may be affected ----------------- Description:...

Ubiquiti Networks UniFi Video Default - crossdomain.xml Security Bypass

Ubiquiti Networks UniFi Video Default - crossdomain.xml Security Bypass source: https://www.securityfocus.com/bid/68866/info UniFi Video is prone to a security-bypass vulnerability. An authenticated attacker can exploit this issue to bypass certain security restrictions and perform unauthorized...

Ubiquiti Networks UniFi Video Default - 'crossdomain.xml' Security Bypass

source: https://www.securityfocus.com/bid/68866/info UniFi Video is prone to a security-bypass vulnerability. An authenticated attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. UniFi Video 2.1.3 is vulnerabl...

Flash "Rosetta" JSONP GET/POST Response Disclosure Exploit

A website that serves a JSONP endpoint that accepts a custom alphanumeric callback of 1200 chars can be abused to serve an encoded swf payload that steals the contents of a same-domain URL. Flash 'Flash "Rosetta" JSONP GET/POST Response Disclosure', 'Description' = %q A website that serves a JSON...

Flash crossdomain.xml 跨站请求伪造

Flash是由macromedia公司推出的交互式矢量图和 Web 动画的标准，由Adobe公司收购。 Flash crossdomain.xml 跨站请求伪造漏洞是指黑客利用Flash跨域配置文件（crossdomain.xml）的配置缺陷进行的跨域攻击。如果网站根目录下有crossdomain.xml文件且这个xml文件的allow-access-from标签为通配符，那么任意域就可以跨域获取本域的隐私数据。 0 Flash 修改crossdomain.xml文件且这个xml文件的allow-access-from标签不为通配符...

Discuz!配置不当可导致CSRF发帖

简要描述： Discuz!配置不当可导致CSRF发帖 详细说明： 这个漏洞中评论说的 WooYun: Discuz!全版本鸡肋CSRF漏洞一枚 ，由于crossdomain.xml配置不当，可能会导致一些问题。评论时只是有个基本的印象，没有实测，既然xsser说有对这个的防御，那来看看是怎么防的. crossdomain.xml的默认设置： 对dz的代码结构不熟，按黑盒来测。 首先是读取那个formhash，看来有了crossdomain.xml的帮助，很容易的读到了当前用户的formhash。 function gethash function getformhashtxt txt =...

Geonick Social Network Clickjacking / Credential Disclosure

Geonick Social Network suffers from a lack of clickjacking protection, it has an insecure crossdomain.xml file, and sends user credentials in the clear. GEONICK SOCIAL-NETWORK Insecure crossdomain.xml file / Clickjacking: X-Frame-Options header missing / User credentials are sent in clear text...

ria_enumerator

This plugin searches for various Rich Internet Application files. It currently searches for: Google gears manifests These files are used to determine which files are locally cached by google gears. They do not get cleared when the browser cache is cleared and may contain sensitive information. Fl...

Sun Java JRE Multiple Vulnerabilities (254569 / 254611 / 254608 ..) (Unix)

The version of Sun Java Runtime Environment JRE installed on the remote host is earlier than 6 Update 13 / 5.0 Update 18 / 1.4.220 / 1.3.125. Such versions are potentially affected by the following security issues : - A denial of service vulnerability affects the JRE LDAP implementation. 254569. ...

JW Player 5.9 Cross Site Scripting / Content Spoofing

Exploit for multiple platform in category web applications Hello list! I want to warn you about security vulnerabilities in JW Player. These are Content Spoofing and Cross-Site Scripting vulnerabilities. ------------------------- Affected products: ------------------------- Vulnerable are JW Play...

Design/Logic Flaw

The SmarterTools SmarterStats 6.0 web server omits the Content-Type header for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving 1 Admin/Defaults/frmDefaultSiteSettings.aspx, 2...

CVE-2011-2159

The SmarterTools SmarterStats 6.0 web server omits the Content-Type header for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving 1 Admin/Defaults/frmDefaultSiteSettings.aspx, 2...

Ucenter Projekt 2.0 - Insecure crossdomain (Cross-Site Scripting)

Ucenter Projekt 2.0 - Insecure crossdomain Cross-Site Scripting ======================================================================================== | Title : Ucenter Projekt 2.0 Insecure crossdomain XSS Vulnerability | Author : indoushka | email : [email protected] | Home :...