5520 matches found
chromium-browser: Side-channel information leakage in content security policy
Information leak in content security policy in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
chromium-browser: Policy bypass in CSP
Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page...
Cross-Site Scripting (XSS)
Jenkins is vulnerable to cross-site scripting XSS. It does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability...
CloudForms: Cross Site Scripting in report menu title / HTML Code Injection
A flaw was found in the Report Menu of Red Hat CloudForms where the title field was not properly sanitized for HTML and JavaScript inputs. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that Content Security Policy can...
Cisco Email Security Appliance and Cisco Content Security Management Appliance Information Disclosure Vulnerability
A vulnerability in the CLI of Cisco AsyncOS for Cisco Email Security Appliance ESA and Cisco AsyncOS for Cisco Content Security Management Appliance SMA could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to excessive...
Debian: Security Advisory (DSA-4739-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DSA-4739-1 : webkit2gtk - security update
The following vulnerabilities have been discovered in the webkit2gtk web engine : - CVE-2020-9862 Ophir Lojkine discovered that copying a URL from the Web Inspector may lead to command injection. - CVE-2020-9893 0011 discovered that a remote attacker may be able to cause unexpected application...
[SECURITY] [DSA 4739-1] webkit2gtk security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4739-1 [email protected] https://www.debian.org/security/ Alberto Garcia August 03, 2020 https://www.debian.org/security/faq -...
[SECURITY] [DSA 4739-1] webkit2gtk security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4739-1 [email protected] https://www.debian.org/security/ Alberto Garcia August 03, 2020 https://www.debian.org/security/faq -...
CVE-2020-10777
A flaw was found in the Report Menu of Red Hat CloudForms where the title field was not properly sanitized for HTML and JavaScript inputs. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that Content Security Policy can...
[ASA-202007-4] ffmpeg: arbitrary code execution
Arch Linux Security Advisory ASA-202007-4 ========================================= Severity: High Date : 2020-07-31 CVE-ID : CVE-2020-13904 Package : ffmpeg Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1180 Summary ======= The package ffmpeg before versi...
Cisco Content Security Management Appliance Input Validation Error Vulnerability (CNVD-2020-44603)
Cisco Content Security Management Appliance SMA is a set of content security management equipment from Cisco Cisco. The appliance is mainly used to manage all policies, reports, audit information, etc. for e-mail and Web security devices. An input validation error vulnerability exists in the Cisc...
PT-2020-6884 · Apple +7 · Ipados +14
Name of the Vulnerable Software and Affected Versions: iOS versions prior to 13.6 iPadOS versions prior to 13.6 tvOS versions prior to 13.4.8 watchOS versions prior to 6.2.8 Safari versions prior to 13.1.2 iTunes versions prior to 12.10.8 for Windows iCloud for Windows versions prior to 11.3 iClo...
UBUNTU-CVE-2020-9915
An access issue existed in Content Security Policy. This issue was addressed with improved access restrictions. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing...
CVE-2020-9915
An access issue existed in Content Security Policy. This issue was addressed with improved access restrictions. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing...
Security Bulletin: : HTTP Header Weakness Affects IBM Secure External Authentication Server
Summary IBM Secure External Authentication Server has been updated to send a proper Content-Security-Policy Header. Vulnerability Details Third Party Entry: PSIRT-ADV0022035 DESCRIPTION: Created from Advisory: ADV0022035 CVSS Base score: 3.1 CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A...
DEBIAN-CVE-2020-6527
Insufficient policy enforcement in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page...
CVE-2020-6527
Insufficient policy enforcement in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page...