UBUNTU-CVE-2018-6164

Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2018-6093

Insufficient origin checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Design/Logic Flaw

Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to install a service worker for a domain that can host attacker controled files via a crafted HTML page...

CVE-2018-6093

Insufficient origin checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2018-6164

Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2018-20071

CVE-2018-20071 affects Google Chrome Payments: insufficiently strict origin checks during JIT payment app installation allowed a remote attacker to install a service worker for a domain hosting attacker-controlled files via a crafted HTML page. Affected: Payments component in Chrome prior to vers...

CVE-2018-6164

CVE-2018-6164 relates to Google Chrome/Chromium’s Blink component. The initial CVE description notes “insufficient origin checks for CSS content in Blink” which allowed a remote attacker to leak cross-origin data via a crafted HTML page. Connected documents corroborate a broader class of cross-or...

CVE-2018-20071

Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to install a service worker for a domain that can host attacker controled files via a crafted HTML page...

CVE-2018-6093

CVE-2018-6093 affects Google Chrome/Chromium Blink: a vulnerability in origin checks that could allow a remote attacker to bypass same-origin protections and leak cross-origin data via crafted HTML. The issue is listed as a Same Origin Policy bypass in Service Worker/Blink components. Debian and ...

CVE-2018-6164

Removed by vendor...

CVE-2018-20071

Removed by vendor...

Design/Logic Flaw

The SV3C HD Camera L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B does not perform origin checks on URLs that the camera's web interface redirects a user to. This can be leveraged to send a user to an unexpected endpoint...

CVE-2018-12675

The SV3C HD Camera L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B does not perform origin checks on URLs that the camera's web interface redirects a user to. This can be leveraged to send a user to an unexpected endpoint...

CVE-2018-6164

Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2018-6093

Insufficient origin checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Ubuntu 14.04 LTS / 16.04 LTS : Oxide vulnerabilities (USN-2960-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2960-1 advisory. An out of bounds write was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potential...

Ubuntu 16.04 LTS : libndp vulnerability (USN-2980-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2980-1 advisory. Julien Bernard discovered that libndp incorrectly performed origin checks when receiving Neighbor Discovery Protocol NDP messages. A remote attacker outside of th...

DSA-3581-1 libndp - security update

Bulletin has no description...

UBUNTU-CVE-2016-2820

The Firefox Health Reports aka FHR or about:healthreport feature in Mozilla Firefox before 46.0 does not properly restrict the origin of events, which makes it easier for remote attackers to modify sharing preferences by leveraging access to the remote-report IFRAME element...

CVE-2016-1658

The Extensions subsystem in Google Chrome before 50.0.2661.75 incorrectly relies on GetOrigin method calls for origin comparisons, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted extension...