UBUNTU-CVE-2017-14718

Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL...

CVE-2017-14718

Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL...

CVE-2017-14718: Improper Neutralization of Input During Web Page Generation

Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL...

PT-2017-13647

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.8.2 Description The issue allows for a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. Recommendations For versions prior to 4.8.2, update to version 4.8.2 or later to resolve the iss...

CVE-2017-11651: Improper Neutralization of Input During Web Page Generation

NexusPHP V1.5 has XSS via a javascript: or data: URL in a UBBCode url tag...

PT-2017-12148

Name of the Vulnerable Software and Affected Versions NexusPHP version 1.5 Description The issue allows for XSS via a javascript: or data: URL in a UBBCode url tag. Recommendations For NexusPHP version 1.5, consider validating and sanitizing user input in UBBCode url tags to prevent XSS attacks. ...

PT-2017-3378

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 56 Mozilla Firefox ESR versions prior to 52.4 Mozilla Thunderbird versions prior to 52.4 Description The issue is related to the Phishing and Malware Protection feature, which failed to properly check file...

DEBIAN-CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs...

UBUNTU-CVE-2017-5466

If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will run the reloaded "data:text/html" page with its origin set incorrectly. This allows for a cross-site scripting XSS attack. This vulnerability affects Thunderbi...

CVE-2017-7188

Zurmo 3.1.1 Stable allows a Cross-Site Scripting XSS attack with a base64-encoded SCRIPT element within a data: URL in the returnUrl parameter to default/toggleCollapse...

Cross site scripting

Zurmo 3.1.1 Stable allows a Cross-Site Scripting XSS attack with a base64-encoded SCRIPT element within a data: URL in the returnUrl parameter to default/toggleCollapse...

CVE-2017-7188: Improper Neutralization of Input During Web Page Generation

Zurmo 3.1.1 Stable allows a Cross-Site Scripting XSS attack with a base64-encoded SCRIPT element within a data: URL in the returnUrl parameter to default/toggleCollapse...

PT-2017-17566

Name of the Vulnerable Software and Affected Versions Zurmo version 3.1.1 Description The issue allows for a Cross-Site Scripting XSS attack. This can be achieved by using a base64-encoded SCRIPT element within a data: URL in the returnUrl parameter to default/toggleCollapse. Recommendations For...

Mozilla: Restricted external resources can be loaded by SVG images through data URLs (MFSA 2016-94, MFSA 2016-95)

External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs. This could allow for cross-domain data leakage. This vulnerability affects Firefox 50.1, Firefox ESR 45.6, and Thunderbird 45.6...

Security update for MozillaFirefox (important)

MozillaFirefox is updated to version 50.0.2 which fixes the following issues: Firefox crashed with 3rd party Chinese IME when using IME text fixed in version 50.0.1 Redirection from an HTTP connection to a data: URL could inherit wrong origin after an HTTP redirect fixed in version 50.0.1,...

Mozilla Firefox Security Advisories (MFSA2016-91, MFSA2016-91) - Windows

Mozilla Firefox is prone to an URL redirection vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

UBUNTU-CVE-2016-9078

Redirection from an HTTP connection to a "data:" URL assigns the referring site's origin to the "data:" URL in some circumstances. This can result in same-origin violations against a domain if it loads resources from malicious sites. Cross-origin setting of cookies has been demonstrated without t...

CVE-2016-9078

Redirection from an HTTP connection to a "data:" URL assigns the referring site's origin to the "data:" URL in some circumstances. This can result in same-origin violations against a domain if it loads resources from malicious sites. Cross-origin setting of cookies has been demonstrated without t...

FreeBSD : mozilla -- data: URL can inherit wrong origin after an HTTP redirect (f90fce70-ecfa-4f4d-9ee8-c476dbf4bf0e)

The Mozilla Foundation reports : Redirection from an HTTP connection to a data: URL assigns the referring site's origin to the data: URL in some circumstances. This can result in same-origin violations against a domain if it loads resources from malicious sites. Cross-origin setting of cookies ha...

KLA10909 Security vulnerabilitity in Mozilla Firefox

An unspecified vulnerability was found in Mozilla Firefox 49 and 50. It can be exploited to gain priveleges. Technical details Redirection from HTTP connection to a data:URL assigns the referring of site origin to the data: URL in some cases. Because of that same-origin violations against a domai...