Mozilla Firefox Reader View Feature Cross-Site Scripting Vulnerability

Mozilla Firefox is an open source web browser. A security vulnerability exists in the Mozilla Firefox Reader View feature that allows remote attackers to bypass the Content Security Policy CSP protection mechanism and conduct cross-site scripting attacks...

CVE-2015-4518

The Reader View implementation in Mozilla Firefox before 42.0 has an improper whitelist, which makes it easier for remote attackers to bypass the Content Security Policy CSP protection mechanism and conduct cross-site scripting XSS attacks via vectors involving SVG animations and the about:reader...

Cross site scripting

The Reader View implementation in Mozilla Firefox before 42.0 has an improper whitelist, which makes it easier for remote attackers to bypass the Content Security Policy CSP protection mechanism and conduct cross-site scripting XSS attacks via vectors involving SVG animations and the about:reader...

HackerOne: Cross-domain AJAX request

Hi, Two weeks ago, I found a Cross-domain AJAX request, but due to the fact that you uses a very strict Content Security Policy, I hesitated to send this. Today, I noticed that bug has been fixed. But this fix can be bypassed. This example not working now screenshot 1:...

CVE-2015-4518

Mozilla Firefox CVE-2015-4518 describes an improper Reader View whitelist that can bypass CSP protections, enabling cross-site scripting via SVG-related vectors and the about:reader URL in Firefox versions before 42.0. Affected product: Firefox Reader View. Root cause: overly permissive allowlist...

Firefox < 42 Multiple Vulnerabilities (Mac OS X)

The version of Firefox installed on the remote Mac OS X host is prior to 42. It is, therefore, affected by the following vulnerabilities : - Multiple memory corruption issues exist due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these issues, via...

UBUNTU-CVE-2015-4518

The Reader View implementation in Mozilla Firefox before 42.0 has an improper whitelist, which makes it easier for remote attackers to bypass the Content Security Policy CSP protection mechanism and conduct cross-site scripting XSS attacks via vectors involving SVG animations and the about:reader...

CVE-2015-4518

The Reader View implementation in Mozilla Firefox before 42.0 has an improper whitelist, which makes it easier for remote attackers to bypass the Content Security Policy CSP protection mechanism and conduct cross-site scripting XSS attacks via vectors involving SVG animations and the about:reader...

HackerOne: Send AJAX request to external domain

Hello! I would like to report about ability to send AJAX request from hackerone.com to external domain. Here is PoC for the last version of Internet Explorer: https://hackerone.com/bugs?subject=%2Fbigbob.lv%2F1337.php%3Fdata%3D If You visit it, You can see Hello! This is custom text from external...

Here's How Websites Are Tracking You Online

Webmasters can track all your activities on the Internet – even if you have already cleared your browsing history and deleted all saved cookies. A researcher demonstrated two unpatched flaws that can be exploited to track Millions of Internet users, allowing malicious website owners: 1. List...

MGASA-2015-0414 Updated iceape/sqlite3 packages fix security vulnerabilities

Updated iceape packages fix security issues. The sqlite3 package has been updated as well since the new iceape version requires the SQLITEENABLEDBSTATVTAB feature to be enabled in sqlite. This sqlite3 update also enables ICU support, fixing bug 16814 . Use-after-free vulnerability in the...

Updated iceape/sqlite3 packages fix security vulnerabilities

Updated iceape packages fix security issues. The sqlite3 package has been updated as well since the new iceape version requires the SQLITEENABLEDBSTATVTAB feature to be enabled in sqlite. This sqlite3 update also enables ICU support, fixing bug 16814 . Use-after-free vulnerability in the...

The vulnerability of Safari browser and iOS operating system allows attackers to gain access to protected information.

The vulnerability of the Content Security Policy implementation in the WebKit component of the Safari browser and the iOS operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, acting remotely, to gain access to protected...

X (Formerly Twitter): Highly wormable clickjacking in player card

Hi, I would like to report an issue where player card is vulnerable to clickjacking in certain browsers. This may result in something similar to XSS worm and many other critical damages. Details Twitter Player Card allows a website to embed a custom playerhtml into an iframe in a tweet. There are...

Apple Patches iOS Ins0mnia Vulnerability

Apple’s monster security update of Aug. 13 included a patch for an iOS vulnerability that could beacon out location data and other personal information from a device, even if a particular task has been shut off by the user. A mobile app exploiting this vulnerability could also look benign enough ...

Web Application Potentially Vulnerable to Clickjacking

The remote web server does not set an X-Frame-Options response header or a Content-Security-Policy 'frame-ancestors' response header in all content responses. This could potentially expose the site to a clickjacking or UI redress attack, in which an attacker can trick a user into clicking an area...

Ubuntu 14.04 LTS : Firefox regression (USN-2702-3)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2702-3 advisory. USN-2702-1 fixed vulnerabilities in Firefox. After upgrading, some users in the US reported that their default search engine switched to Yahoo. This update fixes...

Mozilla Firefox Unicode Character Handling Cross-Site Scripting Vulnerability

Mozilla Firefox is an open source WEB browser. Mozilla Firefox suffers from a security vulnerability in the handling of wildcards in the content security policy in 'blob:', 'data:' and filesystem:' URLs, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML...

Apple Safari Cross-Domain Sensitive Information Disclosure Vulnerability

Apple Safari is an open source WEB browser. A security vulnerability exists in Apple Safari that can be exploited by remote attackers to construct malicious web pages that can be tricked into being parsed by users, and that can be used to obtain cookie information from different domains via a...

Mozilla Firefox Multiple Vulnerabilities (Aug 2015) - Windows

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...