Authorization Bypass

firefox is vulnerable to authorization bypass. The vulnerability exists through HTTPS pages embedded in a HTTP page, a service worker registered for the former could have intercepted the request for the secure page despite the iframe not being a secure context due to the insecure framing...

PT-2020-16588

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 84 Description The issue occurs when a HTTPS page is embedded in a HTTP page and a service worker is registered for the secure page. In such cases, the service worker could intercept the request for the secure page,...

UBUNTU-CVE-2020-26976

When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the insecure framing. This vulnerability affects Firefox 84...

CVE-2020-26976

When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the insecure framing. This vulnerability affects Firefox 84...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox versions prior to 84. When an HTTPS page is embedded in an HTTP paqe and a service worker is registered for the former, the service worker can interce...

Security Vulnerabilities fixed in Firefox 84 — Mozilla

When a BigInt was right-shifted the backing store was not properly cleared, allowing uninitialized memory to be read. Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. The lifecycle of IPC Actors allows managed actors t...

DEBIAN-CVE-2020-26958

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox 83, Firefox ESR 78.5,...

Mozilla: Requests intercepted through ServiceWorkers lacked MIME type restrictions

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox 83, Firefox ESR 78.5,...

Mozilla: Requests intercepted through ServiceWorkers lacked MIME type restrictions

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox 83, Firefox ESR 78.5,...

Mozilla: Requests intercepted through ServiceWorkers lacked MIME type restrictions

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox 83, Firefox ESR 78.5,...

Mozilla: Requests intercepted through ServiceWorkers lacked MIME type restrictions

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox 83, Firefox ESR 78.5,...

Mozilla: Requests intercepted through ServiceWorkers lacked MIME type restrictions

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox 83, Firefox ESR 78.5,...

Mozilla Firefox ESR Cross-Site Scripting Vulnerability

Mozilla Firefox ESR is an extended support release of Firefox web browser from the Mozilla Foundation. A cross-site scripting vulnerability exists in FireFox that stems from Firefox not blocking the execution of scripts that use incorrect MIME types when the response is intercepted and cached by...

UBUNTU-CVE-2020-26958

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox 83, Firefox ESR 78.5,...

Timers, Metrics, and Dimensions: What's New in mPulse in 2020

The October 2020 release marks the culmination of a large number of updates to mPulse, Akamai's real user monitoring RUM solution: 8 New timers 2 New metrics 5 New dimensions UI improvements Extra custom timer capabilities With all of these new changes, you can easily determine and tune the...

A padlock problem

There's a difference between what the browser 🔒 means to users, vs what it means to browsers. To users, it means "the page is secure", but to the browser: The certificate dialog in Chrome …it means the "connection" is secure. This is because the security check happens as part of setting up the...

Different versions of your site can be running at the same time

It's pretty easy for a user to be running an old version of your site. Not only that, but a user could be running many different versions of your site at the same time, in different tabs, and that's kinda terrifying. For instance: 1. A user opens your site. 2. You deploy an update. 3. The user...

[SECURITY] [DSA 4714-3] chromium regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-4714-3 [email protected] https://www.debian.org/security/ Michael Gilbert July 13, 2020 https://www.debian.org/security/faq -...

Google Chrome Service Worker

The vulnerability of the Service Worker component in Google Chrome browser relates to the use of freed memory areas. Exploiting this vulnerability could allow an attacker to compromise data integrity, cause service failures, or gain unauthorized access to confidential information through a...

Abusing the Service Workers API

The Service Worker web API is a powerful new API for web browsers. During our research, we have found several ways attackers can leverage this API to enhance their low-to-medium risk findings into a powerful and meaningful attack. By...