Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 91 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 91.0.4472.77 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming...

UBUNTU-CVE-2021-29625

Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a pdo...

SOURCEFORGE Adminer 跨站脚本漏洞

SOURCEFORGE Adminer is an application from the American SOURCEFORGE community. Provides database management in a single PHP file. A security vulnerability exists in Adminer versions 4.6.1 through 4.8.0, which stems from Adminer's use of the pdo extension to communicate with the database, and...

Ubuntu 20.04 LTS : Thunderbird vulnerabilities (USN-4936-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4936-1 advisory. Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attack...

Content-Security Policy (CSP) Bypas

firefox is vulnerable to content-security policy bypass. Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allows the execution of scripts that should have been blocked...

Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2021:0656)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:0656-1 advisory. - Mozilla: Content Security Policy violation report could have contained the destination of a redirect CVE-2021-23968, CVE-2021-23969 - Mozilla:...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2021:0661)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:0661-1 advisory. - Mozilla: Content Security Policy violation report could have contained the destination of a redirect CVE-2021-23968, CVE-2021-23969 - Mozilla:...

HTML Injection

firefox is vulnerable to HTML injection. Lack of escaping allows an attacker to inject and execute arbitrary HTML in a user's browser when a webpage was viewed in Reader View. While a secure Content Security Policy prevents direct code execution, HTML injection is still possible...

SUSE: Security Advisory (SUSE-SU-2021:0676-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogs

Impact The Nextcloud dialogs library before 3.1.2 did insufficiently escape text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability. Note: Nextcloud Server employs a strict Content Security Policy that mitigates the risk o...

GHSA-G3FQ-3V3G-MH32 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogs

Impact The Nextcloud dialogs library before 3.1.2 did insufficiently escape text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability. Note: Nextcloud Server employs a strict Content Security Policy that mitigates the risk o...

Stripo Inc: Bypassing Content-Security-Policy leads to open-redirect and iframe xss

Summary: https://my.stripo.email/cabinet//template-editor/..... has the ff: code to make iframes more secure: html pointing to other domains won't work but, the whitelist in frame-src data has listed .firebaseapp.com, a free hosting domain, leading to iframe abuse and redirects Steps To Reproduce...

openSUSE: Security Advisory for MozillaThunderbird (openSUSE-SU-2021:0387-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Error Accessing Citrix Environment Using StoreFront 2.x and HTML5 Receiver 1.3 on Chrome v40 and Later

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Users get error when accessing Citrix environment using StoreFront 2.x and HTML5 Receiver 1.3 on...

PT-2021-7320 · Apple +7 · Macos Monterey +12

Name of the Vulnerable Software and Affected Versions: WPE WebKit versions prior to the fixed version iOS versions prior to 15.1 iPadOS versions prior to 15.1 macOS Monterey versions prior to 12.0.1 iOS versions prior to 14.8.1 iPadOS versions prior to 14.8.1 tvOS versions prior to 15.1 watchOS...

The vulnerability of Google Chrome’s Content Security Policy component allows a perpetrator to access confidential data.

The vulnerability of Google Chrome’s Content Security Policy component is related to improper security checks for standard elements. Exploiting this vulnerability can allow an attacker to gain access to confidential data...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-4756-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4756-1 advisory. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker...

The vulnerability of Google Chrome’s Content Security Policy component allows a perpetrator to compromise data integrity.

The vulnerability of Google Chrome’s Content Security Policy component is related to the lack of standard permission mechanisms. Exploiting this vulnerability could allow a malicious actor to compromise data integrity remotely...

The vulnerability of Google Chrome’s Content Security Policy component allows a perpetrator to access confidential data.

The vulnerability of Google Chrome’s Content Security Policy component is related to the disclosure of information. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to confidential data...

Important: thunderbird

Issue Overview: If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs. This vulnerability affec...