CVE-2019-5864

Insufficient data validation in CORS in Google Chrome prior to 76.0.3809.87 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension...

CVE-2019-5864

Insufficient data validation in CORS in Google Chrome prior to 76.0.3809.87 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension...

CVE-2019-13704

Insufficient policy enforcement in navigation in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass content security policy via a crafted HTML page...

CVE-2019-13704

CVE-2019-13704 affects Google Chrome/Chromium before 78.0.3904.70 and is described as an access restriction bypass via CSP, specifically a Content Security Policy bypass. Connected advisories confirm the issue as a CSP bypass vulnerability in Chromium/Chrome, with remediation guidance to upgrade ...

CVE-2019-13704

Insufficient policy enforcement in navigation in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass content security policy via a crafted HTML page...

CVE-2019-13662

CVE-2019-13662 affects Chromium/Google Chrome: insufficient policy enforcement in navigations allows bypassing Content Security Policy via a crafted HTML page. Root cause: CSP bypass in navigation handling. Impact: CSP bypass without explicit exploitation details; vulnerable components reported a...

CVE-2019-13662

Insufficient policy enforcement in navigations in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML page...

CVE-2019-13662

Insufficient policy enforcement in navigations in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML page...

CVE-2019-13664

Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML page...

CVE-2019-13664

Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML page...

CVE-2019-13664

CVE-2019-13664 : In Chromium/Blink, insufficient policy enforcement allowed bypassing the Content Security Policy via a crafted HTML page. Affected products are Chromium/Google Chrome (Blink engine); the issue is tied to CSP bypass in the rendering/Blink path. Debian security advisory DSA-4562-1 ...

Cross-Site Scripting (XSS)

pimcore/pimcore is vulnerable to cross-site scripting XSS. The showEmailLogAction function in bundles/AdminBundle/Controller/Admin/EmailController.php allows script execution in the Email Log preview window due to the lack of a Content-Security-Policy header...

CVE-2019-18982

bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header...

CVE-2019-18982

bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header...

CVE-2019-18982

bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header...

CVE-2019-18982

bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header...

Debian DSA-4562-1 : chromium - security update

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2019-5869 Zhe Jin discovered a use-after-free issue. - CVE-2019-5870 Guang Gong discovered a use-after-free issue. - CVE-2019-5871 A buffer overflow issue was discovered in the skia library. - CVE-2019-5872 Zhe Jin...

The vulnerability of the software authentication module of the Cisco Content Security Management Appliance allows a hacker to gain access to spam messages from other users.

The vulnerability of the software authentication module of the Cisco Content Security Management Appliance is related to authentication errors. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to spam messages from other users...

DEBIAN-CVE-2018-21030

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...

PYSEC-2019-157

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...