111 matches found
WebKitGTK+ Code Execution / Cookie Handling / Memory Corruption Vulnerabilities
WebKitGTK+ has had numerous security vulnerabilities addressed including arbitrary code execution, memory corruption, cookie theft, and various other issues. ------------------------------------------------------------------------ WebKitGTK+ Security Advisory...
Queries regarding app intent and allowed URL schemes
While developing Enterprise app w.r.t app intent and allowed URL schemes we need to follow the below Guide . Android App- How to add Intent Filters for Deep Links, Read Data from Incoming Intents iOS App-How to Implement Custom URL Schemes. XenMobile 10.x Enterprise Apps iPa and APK...
CVE-2016-5193
Google Chrome prior to 54.0 for iOS had insufficient validation of URLs for windows open by DOM, which allowed a remote attacker to bypass restrictions on navigation to certain URL schemes via crafted HTML pages...
chromium-browser: Scheme bypass in CSP
The CSPSourceList::matches function in WebKit/Source/core/frame/csp/CSPSourceList.cpp in the Content Security Policy CSP implementation in Google Chrome before 47.0.2526.73 accepts a blob:, data:, or filesystem: URL as a match for a pattern, which allows remote attackers to bypass intended scheme...
iBackDoor: High-Risk Code Hits iOS Apps
Introduction FireEye mobile researchers recently discovered potentially “backdoored” versions of an ad library embedded in thousands of iOS apps originally published in the Apple App Store. The affected versions of this library embedded functionality in iOS apps that used the library to display...
CVE-2015-4490
The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob, data, and filesystem URL schemes during wildcard source-expression matching, which might make it easier for remote...
Internet Bug Bounty: Internet-based attacker can run Flash apps in local sandboxes by using special URL schemes (PSIRT-3299, CVE-2015-3079)
Some of the sandbox logic of Flash Player can be circumvented on most web browsers by using special URL schemes. A website can deploy an SWF file via the data: or blob: URL schemes perhaps others. An app started in this way runs in the "local with files" or "local with networking" sandbox,...
X (Formerly Twitter): iOS App can establish Facetime calls without user's permission
When URL Schemes for local applications are inserted in an inline frame, the web view launches them automatically. Example: Facetime Audio URL Scheme Test This page which you can also find at http://binaryfactory.ca/urlschemes/facetime.html - when loaded from Twitter on iOS including 8,...
RHEL 4 : python (RHSA-2011:0491)
The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0491 advisory. Python is an interpreted, interactive, object-oriented programming language. A flaw was found in the Python urllib and urllib2 libraries whe...
Malicious URLs Pose Mobile Hijacking Risk
The security of mobile devices may be at risk for Web borne attacks because of loose policies for processing URLs Uniform Resource Locators, according to a report by security researcher Nitesh Dhajani. Writing on the SANS Application Security Blog, Dhanjani said that that way the iPhone’s operati...
