CVE-2021-23957

Navigations through the Android-specific intent URL scheme could have been misused to escape iframe sandbox. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox 85...

CVE-2021-23957: Undefined Security Weakness

Navigations through the Android-specific intent URL scheme could have been misused to escape iframe sandbox. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox 85...

Security update for mumble (moderate)

openSUSE Security Update: Security update for mumble Announcement ID: openSUSE-SU-2021:0312-1 Rating: moderate References: 1180068 1182123 Affected Products: openSUSE Backports SLE-15-SP2 An update that contains security fixes can now be installed. Description: This update for mumble fixes the...

Mozilla Firefox < 85.0

The version of Firefox installed on the remote Windows host is prior to 85.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-03 advisory. - Mozilla developers Sebastian Hengst, Christian Holler, Tyson Smith reported memory safety bugs present in Firefox 84...

PT-2021-2602

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 85 Description The issue is related to errors in privilege management within the isolated environment of the Firefox for Android browser's iframe. It could allow a remote attacker to impact data integrity...

Engel & Völkers Technology GmbH: Blind SSRF on infodesk.engelvoelkers.com via proxy.php

Summary: The application has a proxy.php file which basically accepts a parameter via url query parameter and passes it to fopen. However, it doesn't validate the parameter value prior to passing it to fopen- making it possible to influence what's being done. That said, because of code following...

CVE-2020-9860

A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in Safari 13.0.5. Processing a maliciously crafted URL may lead to arbitrary javascript code execution...

CVE-2020-3852

A logic issue was addressed with improved validation. This issue is fixed in Safari 13.0.5. A URL scheme may be incorrectly ignored when determining multimedia permission for a website...

Input validation

A logic issue was addressed with improved validation. This issue is fixed in Safari 13.0.5. A URL scheme may be incorrectly ignored when determining multimedia permission for a website...

Input validation

A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in Safari 13.0.5. Processing a maliciously crafted URL may lead to arbitrary javascript code execution...

CVE-2020-9860

A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in Safari 13.0.5. Processing a maliciously crafted URL may lead to arbitrary javascript code execution...

CVE-2020-9860

CVE-2020-9860 affects Safari on macOS (and WebKit components) prior to version 13.0.5. The root cause is improper input validation in the handling of custom URL schemes, which could allow a malicious URL to trigger arbitrary JavaScript execution. Apple’s fix is to address this input validation is...

CVE-2020-3852

A logic issue was addressed with improved validation. This issue is fixed in Safari 13.0.5. A URL scheme may be incorrectly ignored when determining multimedia permission for a website...

CVE-2020-3852

CVE-2020-3852 is an Apple Safari/WebKit vulnerability where a logic issue in URL scheme handling caused the scheme to be incorrectly ignored when determining multimedia permissions for a website. Affected product/version: Safari 13.0.5 (and related WebKit handling described in the Apple advisory)...

CVE-2020-9860: Undefined Security Weakness

A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in Safari 13.0.5. Processing a maliciously crafted URL may lead to arbitrary javascript code execution...

CVE-2020-3852: Incorrect Authorization

A logic issue was addressed with improved validation. This issue is fixed in Safari 13.0.5. A URL scheme may be incorrectly ignored when determining multimedia permission for a website...

CVE-2020-6827

When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into displaying the incorrect URI. Note: This issue only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox ESR...

About the security content of Safari 13.0.5

About the security content of Safari 13.0.5 This document describes the security content of Safari 13.0.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

PT-2019-19219 · Shazam · Shazam Android App +1

Name of the Vulnerable Software and Affected Versions: Shazam Android App versions prior to 9.25.0 Shazam iOS App versions prior to 12.11.0 Description: An issue existed in the parsing of URL schemes, which was addressed with improved URL validation. Processing a maliciously crafted URL may lead ...

python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms

urllib in Python 2.x through 2.7.16 supports the localfile: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen'localfile:///etc/passwd' call...