CVE-2018-17195

The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle MiTM attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access,...

CVE-2018-17195

The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle MiTM attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access,...

CVE-2018-17195

Apache NiFi template upload API is vulnerable to CSRF due to missing CORS filtering on the template/upload endpoint. The issue allows cross-origin requests that can lead to unauthorized operations when combined with a MiTM/ARP-spoofing scenario. Affected versions include NiFi 1.0.0 through 1.7.1 ...

Chaturbate: Cross-origin resource sharing: arbitrary origin trusted on chatws25.stream.highwebmedia.com

Very low-quality reports, such as those which only contain automated output, will be rejected. Summary Hi, i was able to discover a number of instances on chatws25.stream.highwebmedia.com were the application accepts an arbitrarily supplied origin. The application implements an HTML5 cross-origin...

Microsoft Edge Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists when Microsoft Edge improperly handles redirect requests. The vulnerability allows Microsoft Edge to bypass Cross-Origin Resource Sharing CORS redirect restrictions, and to follow redirect requests that should otherwise be ignored. An attacker who...

[SECURITY] [DSA 4256-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4256-1 [email protected] https://www.debian.org/security/ Michael Gilbert July 26, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4256-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4256-1 [email protected] https://www.debian.org/security/ Michael Gilbert July 26, 2018 https://www.debian.org/security/faq -...

Debian DSA-4256-1 : chromium-browser - security update

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2018-4117 AhsanEjaz discovered an information leak. - CVE-2018-6044 Rob Wu discovered a way to escalate privileges using extensions. - CVE-2018-6150 Rob Wu discovered an information disclosure issue this problem was...

Information Disclosure

ASP.NET Core is affected by an information disclosure vulnerability. An attacker is able to bypass cross-origin resource sharing configurations to retrieve content from a web application...

Cisco DNA Center Cross Origin Resource Sharing Vulnerability

A vulnerability in the web framework of the Cisco Digital Network Architecture Center DNA Center could allow an unauthenticated, remote attacker to communicate with the Kong API server without restriction. The vulnerability is due to an overly permissive Cross Origin Resource Sharing CORS policy...

resteasy: Vary header not added by CORS filter leading to cache poisoning

It was discovered that the CORS Filter did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances...

Semrush: CORS (Cross-Origin Resource Sharing)

Affected URL: https://ta.semrush.com/version/ Description: The application implements an HTML5 cross-origin resource sharing CORS policy for this request which allows access from any domain. Allowing access from all domains means that any domain can perform two-way interaction with the applicatio...

Microsoft Edge Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists when Microsoft Edge improperly handles redirect requests. The vulnerability allows Microsoft Edge to bypass Cross-Origin Resource Sharing CORS redirect restrictions, and to follow redirect requests that should otherwise be ignored. An attacker who...

KB4048953: Windows 10 Version 1607 and Windows Server 2016 November 2017 Cumulative Update

The remote Windows host is missing security update 4048953. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass vulnerability exists when Microsoft Edge improperly handles redirect requests. The vulnerability allows Microsoft Edge to bypass Cross- Origin Resource...

Microsoft Edge CORS Security Feature Bypass Vulnerability

Microsoft Edge is a popular browser. Microsoft Edge does not properly handle redirection requests, allowing remote attackers to exploit a vulnerability that could be exploited to construct malicious WEB pages that could be tricked into being parsed by users to bypass cross-origin resource sharing...

CVE-2017-5069

Incorrect MIME type of XSS-Protection reports in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to circumvent Cross-Origin Resource Sharing checks via a crafted HTML page...

CVE-2017-5069

Incorrect MIME type of XSS-Protection reports in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to circumvent Cross-Origin Resource Sharing checks via a crafted HTML page...

CVE-2017-5069

Incorrect MIME type of XSS-Protection reports in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to circumvent Cross-Origin Resource Sharing checks via a crafted HTML page...

CVE-2017-5069

Removed by vendor...

CVE-2017-5069

CVE-2017-5069 affects Google Chrome (Blink) and its XSS-Protection reporting mime types. Root cause: incorrect MIME type handling in Blink, allowing a crafted HTML page to bypass Cross-Origin Resource Sharing checks. Impact: mitigates same-origin policy checks; versioned fixes exist in Chrome 58....