10101 matches found
Ubuntu: Security Advisory (USN-2895-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-2895-1: Oxide vulnerabilities
The DOM implementation in Chromium did not properly restrict frame-attach operations from occurring during or after frame-detach operations. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. CVE-2016-16...
Ebay Cross Site Scripting
Hello all, Description: Persistent DOM based Cross Site Scripting on ebay.com domain. Disclosed to Ebay: January 2015 Fixed: February 2016 Vulnerability location: Every listing Who are able to create: Sellers Same origin policy bypass via postMessage Write-up:...
chromium-browser: same-origin bypass in DOM
The DOM implementation in Google Chrome before 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to FrameLoader.cpp,...
Microsoft Producer for Microsoft Office PowerPoint vulnerable to cross-site scripting
Overview Microsoft Producer for Microsoft Office PowerPoint may create a web page which contains a DOM-based cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Do not use Microsoft Producer for Microsoft Office PowerPoint...
CVE-2016-1623
The DOM implementation in Google Chrome before 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to FrameLoader.cpp,...
Design/Logic Flaw
The DOM implementation in Google Chrome before 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to FrameLoader.cpp,...
CVE-2016-1623
CVE-2016-1623 affects Google Chrome before 48.0.2564.109. The DOM implementation does not properly restrict frame-attach operations during or after frame-detach, allowing remote attackers to bypass the Same Origin Policy via a crafted site. Root cause involves functions/files cited: FrameLoader.c...
CVE-2016-1623
The DOM implementation in Google Chrome before 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to FrameLoader.cpp,...
CVE-2016-1623
Removed by vendor...
CVE-2016-1623
The DOM implementation in Google Chrome before 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to FrameLoader.cpp,...
Google Chrome < 48.0.2564.109 Multiple Vulnerabilities
The version of Google Chrome installed on the remote Windows host is prior to 48.0.2564.109. It is, therefore, affected by multiple vulnerabilities as referenced in the 201602stable-channel-update9 advisory. - The Developer Tools aka DevTools subsystem in Google Chrome before 48.0.2564.109 does n...
FreeBSD : chromium -- multiple vulnerabilities (36034227-cf81-11e5-9c2b-00262d5ed8ee)
Google Chrome Releases reports : 6 security fixes in this release, including : - 546677 High CVE-2016-1622: Same-origin bypass in Extensions. Credit to anonymous. - 577105 High CVE-2016-1623: Same-origin bypass in DOM. Credit to Mariusz Mlynski. - 509313 Medium CVE-2016-1625: Navigation bypass in...
Trello: DOM based XSS via Wistia embedding
Hi, You are using Wistia to embed video at trello.com. However external script from fast.wistia.com vulnerable to XSS and allows to run malicious javascript on your side. vulnerable code: fast.wistia.net/assets/external/E-v1.js I found that parameter wchannel can be controled to load js from...
Cisco FireSIGHT Management Center DOM-Based Cross-Site Scripting Vulnerability
Cisco FireSIGHT Management Center MC contains a DOM-based cross-site scripting vulnerability XSS in the management page. An unauthenticated, remote attacker could persuade a user to perform a malicious action, allowing the attacker to perform a XSS attack. The vulnerability is due to mishandling ...
YouYaX v5.85 /Tpl/mobile/home/mypub.html DOM Based XSS
No description provided by source...
ownCloud: Mixed Active Scripting Issue on stats.owncloud.org
I have come across with a HTTPS security issue - compromises HTTPS security by loading images from non secure source in stats.owncloud.org Vulnerability Type: Mixed Active Scripting Issue Description: Mixed Active Content is content that has access to and can affect all or parts of the Document...
CVE-2015-6851
EMC RSA SecurID Web Agent before 8.0 allows physically proximate attackers to bypass the privacy-screen protection mechanism by leveraging an unattended workstation and running DOM Inspector...
Code injection
EMC RSA SecurID Web Agent before 8.0 allows physically proximate attackers to bypass the privacy-screen protection mechanism by leveraging an unattended workstation and running DOM Inspector...