chromium-browser: url leakage via pac script

net/proxy/proxyservice.cc in the Proxy Auto-Config PAC feature in Google Chrome before 52.0.2743.82 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, a related issue to...

Google Chrome URL Forgery Vulnerability

Google Chrome is a web browser developed by the American company Google Google. A URL forgery vulnerability exists in the file ios/web/webstate/ui/crwwebcontroller.mm in versions of Google Chrome prior to 52.0.2743.82 on the iOS platform, which stems from a failure to verify that invalid URLs are...

CVE-2016-5134

net/proxy/proxyservice.cc in the Proxy Auto-Config PAC feature in Google Chrome before 52.0.2743.82 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, a related issue to...

CVE-2016-1707

ios/web/webstate/ui/crwwebcontroller.mm in Google Chrome before 52.0.2743.82 on iOS does not ensure that an invalid URL is replaced with the about:blank URL, which allows remote attackers to spoof the URL display via a crafted web site...

UBUNTU-CVE-2016-5130

content/renderer/historycontroller.cc in Google Chrome before 52.0.2743.82 does not properly restrict multiple uses of a JavaScript forward method, which allows remote attackers to spoof the URL display via a crafted web site...

The vulnerability of Safari browser and iOS operating system allows attackers to obtain confidential information.

The vulnerability of the XSS auditor for the WebKit browser of Safari and the iOS operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain confidential information through a specially crafted U...

The vulnerability of the Apache Struts software platform, which allows a hacker to trigger a service failure

The vulnerability of the URLValidator class in the Apache Struts software framework exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to cause a service failure by using a null value in the URL field...

The vulnerability of the software system for managing enterprise assets in IBM Maximo Asset Management allows a hacker to inject arbitrary Web or HTML code.

The vulnerability of the software system for managing enterprise assets in IBM Maximo Asset Management exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code using a specially crafted U...

IBM Tivoli / Security Directory Server Remote Arbitrary File Viewing Vulnerability

IBM Security Directory Server ISDS, formerly IBM Tivoli Directory Server, ITDS is a suite of enterprise identity management software from IBM in the United States that uses the Lightweight Directory Access Protocol LDAP. The software provides a trusted identity data infrastructure for...

The vulnerability of Google Chrome browser allows a violator to circumvent access restrictions.

The vulnerability of the DecodeHSTSPreloadRaw function in the net/http/transportsecuritystate.cc file of Google Chrome is related to security configuration errors. Exploiting this vulnerability could allow a malicious actor to circumvent access restrictions by manipulating the URL strings...

Vulnerability of Cisco ASA software, allowing attackers to increase their privileges

Vulnerability exists in Cisco’s multi-functional security devices ASA due to improper processing of control session information during privilege verification when connecting to the SSL VPN portal. Exploiting this vulnerability allows remote users who have completed authentication to elevate their...

The vulnerability of the WebSphere Application Server software allows a malicious intruder to compromise the confidentiality of protected information.

The IBM WebSphere Application Server program contains a vulnerability in its security profiles, which allows a malicious attacker to gain access to protected information by manipulating URL requests...

The vulnerability of Google Chrome’s browser allows a malicious actor to replace URLs.

Google Chrome browser contains a vulnerability related to the incorrect processing of bidirectional IRI identifiers in the UnescapeURLWithOffsetsImpl function in net/base/escape.cc. Exploiting this vulnerability allows malicious actors to replace URLs with specially crafted Unicode text that is...

Unspecified vulnerability in Foreman

Foreman is a set of lifecycle management tools for use in physical and virtual servers. An unspecified vulnerability in Foreman 1.11.0 and later can be exploited by an attacker to preview deployment templates by specifying a hostname in the URL...

The vulnerability of the Firefox browser allows a hacker to bypass existing access restrictions and alter the location.host property.

The vulnerability of Firefox browsers is related to access control deficiencies. Exploiting this vulnerability allows a malicious actor to bypass existing access restrictions and alter the location.host property using unreliable URL data...

CVE-2016-2872

Directory traversal vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.7 and QRadar Incident Forensics 7.2.x before 7.2.7 allows remote attackers to read arbitrary files via a crafted URL...

CVE-2016-0400

CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...

IBM WebSphere Application Server HTTP Response Vulnerability

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. There is a security vulnerability in IBM WAS. A remote...

UBUNTU-CVE-2016-1864

The XSS auditor in WebKit, as used in Apple iOS before 9.3 and Safari before 9.1, does not properly handle redirects in block mode, which allows remote attackers to obtain sensitive information via a crafted URL...

Apache Struts2 Remote Code Execution Vulnerability (CNVD-2016-04089)

Apache Struts is the United States Apache Apache Software Foundation is responsible for maintaining an open source project , is a set of open source MVC framework for creating enterprise-class Java Web applications , mainly provides two versions of the framework products , Struts 1 and Struts 2...