8698 matches found
CVE-2014-3160
Removed by vendor...
PT-2014-5117
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 36.0.1985.122 Description The issue is related to the WebMediaPlayerAndroid::load function, which does not properly handle redirects. This allows remote attackers to bypass the Same Origin Policy by hosting a...
CVE-2014-3161: Undefined Security Weakness
The WebMediaPlayerAndroid::load function in content/renderer/media/android/webmediaplayerandroid.cc in Google Chrome before 36.0.1985.122 on Android does not properly interact with redirects, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that hosts a video...
CVE-2014-3160
The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a crafted file...
CVE-2014-3160: Undefined Security Weakness
The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a crafted file...
FreeBSD : chromium -- multiple vulnerabilities (3718833e-0d27-11e4-89db-000c6e25e3e9)
Google Chrome Releases reports : 26 security fixes in this release, including - 380885 Medium CVE-2014-3160: Same-Origin-Policy bypass in SVG. Credit to Christian Schneider. - 393765 CVE-2014-3162: Various fixes from internal audits, fuzzing and other initiatives. %NASLMINLEVEL 70300 C Tenable...
Chrome for Android Update Patches URL Spoofing Bug
The latest update to Chrome on Android – pushed yesterday – fixes two bugs, including a critical flaw in the browser that could have let an attacker trick a user into visiting a malicious site. The problem, marked high priority by Google, was discovered by Japanese app developer Keita Haga. The...
PT-2014-1381
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 36.0.1985.125 Description The issue is related to the ResourceFetcher::canRequest function in Blink, which does not properly restrict subresource requests associated with SVG files. This allows remote attackers ...
Stable Channel Update
The Chrome Team is excited to announce the promotion of Chrome 36 to the Stable channel for Windows, Mac and Linux. Chrome 36.0.1985.125 contains a number of fixes and improvements, including: Rich Notifications Improvements An Updated Incognito / Guest NTP design The addition of a Browser crash...
chromium -- multiple vulnerabilities
Google Chrome Releases reports: 26 security fixes in this release, including 380885 Medium CVE-2014-3160: Same-Origin-Policy bypass in SVG. Credit to Christian Schneider. 393765 CVE-2014-3162: Various fixes from internal audits, fuzzing and other initiatives...
Adobe AIR <= AIR 14.0.0.110 Multiple Vulnerabilities (APSB14-17)
According to its version, the instance of Adobe AIR on the remote Windows host is equal or prior to 14.0.0.110. It is, therefore, affected by the following vulnerabilities : - A CSRF bypassing Same Origin Policy vulnerability exists that could leak potentially sensitive data. CVE-2014-4671 -...
PT-2014-1372
Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 13.0.0.231 Adobe Flash Player versions 14.x prior to 14.0.0.145 Adobe AIR versions prior to 14.0.0.137 Adobe AIR SDK versions prior to 14.0.0.137 Adobe AIR SDK & Compiler versions prior to 14.0.0.137 hapi...
Flash Player for Mac <= 14.0.0.125 Multiple Vulnerabilities (APSB14-17)
According to its version, the instance of Flash Player installed on the remote Mac OS X host is equal or prior to 14.0.0.125. It is, therefore, affected by the following vulnerabilities : - A CSRF bypassing Same Origin Policy vulnerability exists that could leak potentially sensitive data...
MS KB2974008: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer
The remote host is missing KB2974008. It is, therefore, affected by the following vulnerabilities : - A CSRF bypassing Same Origin Policy vulnerability exists that could leak potentially sensitive data. CVE-2014-4671 - Multiple unspecified errors exist that could allow unspecified security bypass...
WebKit JavaScript 'onload()' Event Cross Domain Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/35315/info WebKit is prone to a cross-domain scripting vulnerability because it fails to properly restrict the access of JavaScript code when loading new webpages. A remote attacker can exploit this vulnerability to bypas...
WebKit 'parent/top' Cross Domain Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/35441/info WebKit is prone to a cross-domain scripting vulnerability. A remote attacker can exploit this vulnerability to bypass the same-origin policy and obtain potentially sensitive information or launch spoofing attac...
Mozilla Multiple Products Server Refresh Header XSS
No description provided by source. source: http://www.securityfocus.com/bid/34656/info The Mozilla Foundation has released multiple security advisories specifying various vulnerabilities in Firefox, Thunderbird, and SeaMonkey. Attackers can exploit these issues to bypass same-origin restrictions,...
Mozilla Firefox <= 3.0.3 Internet Shortcut Same Origin Policy Violation Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/31611/info Mozilla Firefox is prone to a vulnerability that allows attackers to violate the same-origin policy. This issue occurs because the application fails to properly enforce the same-origin policy when handling...
MS IE 5/6 OBJECT Tag Same Origin Policy Violation Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5196/info Microsoft Internet Explorer allows script code to violate the same origin policy through usage of the HTML OBJECT tag. Malicious script code may obtain a legitimate reference to an embedded object containing a w...
Microsoft Internet Explorer 5 Dialog Same Origin Policy Bypass Variant Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5561/info Microsoft Internet Explorer includes support for dialog windows through script calls to the two functions showModalDialog and showModelessDialog. These functions accept a URL location for the dialog content, and...