PT-2022-28238 · Lithium +1 · Lithium +2

Name of the Vulnerable Software and Affected Versions: lithium with Swagger-UI enabled affected versions not specified Description: A XSS vulnerability in the provided Swagger-UI is exploitable in applications, allowing an attacker to gain Remote Code Execution RCE and potentially exfiltrate...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:6710)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:6710-1 advisory. - Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh tag CVE-2022-3033 - Mozilla: Bypassing...

Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2022:6711)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:6711-1 advisory. - Mozilla: Bypassing FeaturePolicy restrictions on transient pages CVE-2022-40959 - Mozilla: Data-race when parsing non-UTF-8 URLs in threads...

CVE-2022-38732

SnapCenter versions prior to 4.7 shipped without Content Security Policy CSP implemented which could allow certain types of attacks that otherwise would be prevented...

CVE-2022-38732

SnapCenter versions prior to 4.7 shipped without Content Security Policy CSP implemented which could allow certain types of attacks that otherwise would be prevented...

Code injection

SnapCenter versions prior to 4.7 shipped without Content Security Policy CSP implemented which could allow certain types of attacks that otherwise would be prevented...

CVE-2022-38732

SnapCenter versions prior to 4.7 shipped without Content Security Policy CSP implemented which could allow certain types of attacks that otherwise would be prevented...

CVE-2022-38732

CVE-2022-38732 affects NetApp SnapCenter prior to version 4.7. The issue arises from the absence of a Content Security Policy (CSP), which could allow certain types of attacks that CSP would otherwise mitigate. Red Hat and related feeds corroborate that older SnapCenter builds ship without CSP, c...

CVE-2022-38732

SnapCenter versions prior to 4.7 shipped without Content Security Policy CSP implemented which could allow certain types of attacks that otherwise would be prevented...

NetApp SnapCenter 安全漏洞

NetApp SnapCenter is a suite of applications from Network Appliance NetApp that provides the ability to back up, verify, clone, and restore NetApp storage systems. A security vulnerability exists in NetApp SnapCenter versions prior to 4.7 that stems from a failure to implement a content security...

PT-2022-24546 · Netapp · Snapcenter

Name of the Vulnerable Software and Affected Versions: SnapCenter versions prior to 4.7 Description: The issue is related to the absence of Content Security Policy CSP in SnapCenter, which could allow certain types of attacks that would otherwise be prevented. Recommendations: For SnapCenter...

UBUNTU-CVE-2022-40956

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...

SUSE-SU-2022:3440-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Mozilla Firefox was updated from 102.2.0esr to 102.3.0esr bsc1203477: - CVE-2022-40959: Fixed bypassing FeaturePolicy restrictions on transient pages. - CVE-2022-40960: Fixed data-race when parsing non-UTF-8 URLs in threads. -...

PT-2022-6772 · Google +1 · Google Chrome +1

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 106.0.5249.62 Description: The issue is related to insufficient data validation in DevTools, allowing a remote attacker to bypass content security policy via a crafted HTML page. This could potentially impact a...

Mozilla: Content-Security-Policy base-uri bypass

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that when injecting an HTML base element; some requests would ignore the CSP's base-uri settings and accept the injected element's base instead...

CVE-2022-3056

Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to bypass content security policy via a crafted HTML page...

CVE-2022-3056

Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to bypass content security policy via a crafted HTML page...

DEBIAN-CVE-2022-3056

Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to bypass content security policy via a crafted HTML page...

UBUNTU-CVE-2022-3056

Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to bypass content security policy via a crafted HTML page...

Design/Logic Flaw

Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to bypass content security policy via a crafted HTML page...