11317 matches found
Google Chrome CORS Policy Bypass Vulnerability
Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A CORS policy bypass vulnerability exists in versions of Google Chrome prior to 84.0.4147.89, which can be exploited by an attacker to bypass the policy...
Automattic: Denial-of- service By Cache Poisoning The Cross-Origin Resource Sharing Misconfiguration Allow Origin Header
Summery: The wp-json implementation on some WordPress websites I've tested is vulnerable to Denial-of-service where by an attacker can provide an arbitrary origin header in the request, which is then echoed back in the response via the Access-Control-Allow-Origin header, which is cached and serve...
GitHub Security Lab: [javascript] CWE-020: CodeQL query to detect missing origin validation in cross-origin communication via postMessage
This bug was reported directly to GitHub Security Lab...
CSRF Vulnerability in rails-ujs
There is a vulnerability in rails-ujs that allows attackers to send CSRF tokens to wrong domains. Versions Affected: rails = 5.2.4.3, rails = 6.0.3.1 Impact ------ This is a regression of CVE-2015-1840. In the scenario where an attacker might be able to control the href attribute of an anchor tag...
Amazon Linux 2 : python-urllib3, --advisory ALAS2-2020-1446 (ALAS-2020-1446)
The version of python-urllib3 installed on the remote host is prior to 1.25.7-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1446 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version numbe...
Showmax: [stories.showmax.com] Cross Origin Misconfiguration - Sensitive Information Exposure
The hacker reported user enumaration on https://stories.showmax.com/wp-json/wp/v2/users/ and CORS. The user enumeration didn't disclose any sensitive information except usernames which are not problematic because we have 2FA login in place and the usernames could be obtained even from standard...
UBUNTU-CVE-2020-10753
A flaw was found in the Red Hat Ceph Storage RadosGW Ceph Object Gateway. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the...
X (Formerly Twitter): Android WebViews in Twitter app are vulnerable to UXSS due to configuration and CVE-2020-6506
Summary: CVSS score: 8.1 / High / CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N Embargo notice: Do Not Disclose publicly until https://crbug.com/1083819 is disclosed. Twitter for Android is affected by a UXSS vulnerability due to its configuration of Android WebView and CVE-2020-6506. Vendor...
CVE-2018-18499
A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a redirection to another site using performance.getEntries. This is a same-origin policy violation and could allow for data theft. This vulnerability affects...
Insecure Cookie Parsing
rack does not properly parse the cookie in an HTTP request. This allows an attacker to be able to trick a vulnerable application into processing an insecure non-SSL or cross-origin request if they can gain the ability to write arbitrary cookies that are sent to the application...
Plex Media Server Improper Access Control Vulnerability
Plex Media Server is a set of media player and media server software from the Swiss company Plex. An improper access control vulnerability exists in versions of Plex Media Server prior to 2020-6-15. An attacker could exploit this vulnerability to execute cross-origin application requests via any...
CVE-2020-5742
Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests...
CVE-2020-5742
Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests...
Improper access control
Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests...
CVE-2020-5742
Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests...
CVE-2020-5742
Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests...
CVE-2020-5742
CVE-2020-5742 : Affected software is Plex Media Server. The vulnerability is due to improper access control, allowing any origin to execute cross-origin application requests prior to 2020-06-15. The root cause is inadequate restriction on cross-origin interactions, enabling potentially unauthoriz...
chromium-browser: Insufficient data validation in loader
Insufficient data validation in loader in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had been able to write to disk to leak cross-origin data via a crafted HTML page...
Microsoft Edge Information Leakage Vulnerability (CNVD-2020-61592)
Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. An information disclosure vulnerability exists in the way cross-origin requests are handled in Microsoft Edge. An attacker could exploit the vulnerability to determine the source of all w...