3714 matches found
CVE-2021-38020
Insufficient policy enforcement in contacts picker in Google Chrome on Android prior to 96.0.4664.45 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...
CVE-2021-38020
Insufficient policy enforcement in contacts picker in Google Chrome on Android prior to 96.0.4664.45 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...
CVE-2021-38019
Insufficient policy enforcement in CORS in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2021-38019
CVE-2021-38019 is a Chromium/Chromium-based browser vulnerability describing insufficient policy enforcement in the CORS component prior to 96.0.4664.45, allowing a remote attacker to leak cross-origin data via a crafted HTML page. Connected advisories (Arch Linux ASA/AVGs, Debian DSA, and AS/AST...
CVE-2021-38019
Insufficient policy enforcement in CORS in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2021-38017
Insufficient policy enforcement in iframe sandbox in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...
CVE-2021-38017
Insufficient policy enforcement in iframe sandbox in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...
CVE-2021-38017
CVE-2021-38017 affects Chromium/Google Chrome’s iframe sandbox. Before version 96.0.4664.45, insufficient policy enforcement in the iframe sandbox allowed a remote attacker to bypass navigation restrictions via a crafted HTML page (sandbox escape). The issue is documented across multiple advisori...
CVE-2021-38016
CVE-2021-38016 stems from insufficient policy enforcement in Chromium’s background fetch component, allowing a remote attacker to bypass the same-origin policy via a crafted HTML page. The CVE affects Chromium-based browsers before version 96.0.4664.45 (notably Chrome/Chromium builds referenced i...
CVE-2021-38016
Insufficient policy enforcement in background fetch in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass same origin policy via a crafted HTML page...
CVE-2021-38016
Insufficient policy enforcement in background fetch in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass same origin policy via a crafted HTML page...
Insufficient Policy Enforcement
qt5-qtwebengine:edge is having insufficient policy enforcement in CORS...
HashiCorp Vault Incorrect Permission Assignment for Critical Resource
HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault...
CVE-2021-43998
HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault...
Design/Logic Flaw
HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault...
CVE-2021-43998
HashiCorp Vault and Vault Enterprise were affected by a logic flaw in templated ACL policies: if an entity had multiple aliases for a given entity+mount, the policy could incorrectly apply and match the first-created alias. Affected versions are 0.11.0 through 1.7.5 and 1.8.4. The issue is fixed ...
HashiCorp Vault 安全漏洞
Hashicorp HashiCorp Vault is a private key access management tool from HashiCorp Hashicorp USA. A security vulnerability exists in HashiCorp Vault and Vault Enterprise that stems from a software templated ACL policy that always matches the first entity alias created, which could lead to incorrect...
PT-2021-24000 · Hashicorp · Hashicorp Vault +1
Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.7.5 HashiCorp Vault and Vault Enterprise version 1.8.4 Description: The issue arises when templated ACL policies in HashiCorp Vault and Vault Enterprise match the first-created...
