CVE-2017-7834

A "data:" URL loaded in a new tab did not inherit the Content Security Policy CSP of the original page, allowing for bypasses of the policy including the execution of JavaScript. In prior versions when "data:" documents also inherited the context of the original page this would allow for potentia...

CVE-2018-5108

A Blob URL can violate origin attribute segregation, allowing it to be accessed from a private browsing tab and for data to be passed between the private browsing tab and a normal tab. This could allow for the leaking of private information specific to the private browsing context. This issue is...

CVE-2018-5138

A spoofing vulnerability can occur when a malicious site with an extremely long domain name is opened in an Android Custom Tab a browser panel inside another app and the default browser is Firefox for Android. This could allow an attacker to spoof which page is actually loaded and in use. Note:...

CVE-2017-7812

If web content on a page is dragged onto portions of the browser UI, such as the tab bar, links can be opened that otherwise would not be allowed to open. This can allow malicious web content to open a locally stored file through "file:" URLs. This vulnerability affects Firefox 56...

CVE-2018-5143

URLs using "javascript:" have the protocol removed when pasted into the addressbar to protect users from cross-site scripting XSS attacks, but if a tab character is embedded in the "javascript:" URL the protocol is not removed and the script will execute. This could allow users to be socially...

CVE-2018-5143: Improper Neutralization of Input During Web Page Generation

URLs using "javascript:" have the protocol removed when pasted into the addressbar to protect users from cross-site scripting XSS attacks, but if a tab character is embedded in the "javascript:" URL the protocol is not removed and the script will execute. This could allow users to be socially...

CVE-2018-5138: Improper Input Validation

A spoofing vulnerability can occur when a malicious site with an extremely long domain name is opened in an Android Custom Tab a browser panel inside another app and the default browser is Firefox for Android. This could allow an attacker to spoof which page is actually loaded and in use. Note:...

CVE-2018-11475

Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...

CVE-2018-11475

Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...

Design/Logic Flaw

Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...

CVE-2018-11474

Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...

CVE-2018-11474

Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...

Design/Logic Flaw

Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...

CVE-2018-11474

Monstra CMS 3.0.4 is affected by a Session Management Issue in the Administrations Tab (admin/index.php?id=users&action=edit&user_id=1). According to CVE-2018-11474, changing a user password does not invalidate an active session from another browser, enabling an existing session to remain authent...

CVE-2018-11474

Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...

CVE-2018-11475

Summary : Monstra CMS 3.0.4 is affected by a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser. Impact : a user’s active session remains valid in other browsers after a password change (per the CVE descri...

CVE-2018-11475: Session Fixation

Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...

CVE-2018-11474: Session Fixation

Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...

CVE-2018-11332

Stored cross-site scripting XSS vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted site name to the manager/processors/savesettings.processor.php file...

UBUNTU-CVE-2018-5181

If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child process the tab will open a local file corresponding to the dropped URL, contrary to policy. One way to make the target tab open more reliably in a separate process is to open it with...