DEBIAN-CVE-2017-7006

An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct a timing side-channel attack to bypass the Same Origin Policy and...

Apple Safari Multiple Vulnerabilities (HT207921)

Apple Safari is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apple:safari"; ifdescription...

About the security content of tvOS 10.2.2

About the security content of tvOS 10.2.2 This document describes the security content of tvOS 10.2.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

rack-cors CORS request vulnerability

rack-cors is a middleware for resource sharing across sources. regex is a regular expression created in it. A security vulnerability exists in the regex created in versions of rack-cors prior to 0.4.1. An attacker can exploit this vulnerability to execute cross-origin resource sharing requests...

DEBIAN-CVE-2017-11173

Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net as well as...

UBUNTU-CVE-2017-11173

Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net as well as...

Microsoft EDGE Security Bypass Vulnerability

Microsoft Edge is a popular WEB browser. Microsoft Edge does not properly handle redirect requests, allowing attackers to exploit a vulnerability by submitting a special WEB page that induces users to parse it, which can bypass CORS redirect restrictions...

Microsoft Edge Information Disclosure Vulnerability (CNVD-2017-12109)

Microsoft Edge is a web browser developed by Microsoft USA and is the default browser that comes with the Windows 10 operating system. An information disclosure vulnerability exists in Microsoft Edge. An attacker can exploit the vulnerability by tricking a user into viewing a specially crafted we...

Cross-origin brute-forcing of Github SAML and 2FA recovery codes

Yesterday while reading my Twitter stream I found this interesting article about downloading GitHub SSO bypass codes. Same as Yasin Soliman I was invited to a Github pre-release of the organisation SAML single sign-on SSO private program. And same as him I found an issue in the same endpoint. So ...

chromium-browser: cross-origin bypass in blink

Incorrect MIME type of XSS-Protection reports in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to circumvent Cross-Origin Resource Sharing checks via a crafted HTML page...

Security update for chromium (important)

This update to Chromium 58.0.3029.81 fixes the following security issues bsc1035103: - CVE-2017-5057: Type confusion in PDFium - CVE-2017-5058: Heap use after free in Print Preview - CVE-2017-5059: Type confusion in Blink - CVE-2017-5060: URL spoofing in Omnibox - CVE-2017-5061: URL spoofing in...

openSUSE Security Update : chromium (openSUSE-2017-508)

This update to Chromium 58.0.3029.81 fixes the following security issues bsc1035103 : - CVE-2017-5057: Type confusion in PDFium - CVE-2017-5058: Heap use after free in Print Preview - CVE-2017-5059: Type confusion in Blink - CVE-2017-5060: URL spoofing in Omnibox - CVE-2017-5061: URL spoofing in...

OPENSUSE-SU-2017:1098-1 Security update for chromium

This update to Chromium 58.0.3029.81 fixes the following security issues bsc1035103: - CVE-2017-5057: Type confusion in PDFium - CVE-2017-5058: Heap use after free in Print Preview - CVE-2017-5059: Type confusion in Blink - CVE-2017-5060: URL spoofing in Omnibox - CVE-2017-5061: URL spoofing in...

Chrome Universal XSS by loading a javascript: URI from an unloaded window (CVE-2015-1293)

VULNERABILITY DETAILS From /WebKit/Source/core/frame/DOMWindow.cpp: bool DOMWindow::isInsecureScriptAccessLocalDOMWindow& callingWindow, const String& urlString if !protocolIsJavaScripturlString return false; // If this DOMWindow isn't currently active in the Frame, then there's no // way we shou...

Chrome Universal XSS using a flaw in the load deferral logic

VULNERABILITY DETAILS This is a regression from https://crrev.com/f92a1f3b9 . Previously, ResourceLoader::start bailed out if ResourceLoader::mdefersLoading was true. Now, it calls setDefersLoading on the associated WebURLLoader instead: void ResourceLoader::startResourceRequest& request...

Chrome Universal XSS via persistence of subframes (CVE-2015-6768)

VULNERABILITY DETAILS From /thirdparty/WebKit/Source/core/dom/Document.cpp: bool FrameLoader::prepareForCommit PluginScriptForbiddenScope forbidPluginDestructorScripting; RefPtrWillBeRawPtr pdl = mprovisionalDocumentLoader; ... if mdocumentLoader client-dispatchWillClose; dispatchUnloadEvent;...

Chrome Universal XSS using IDBKeyRange static methods(CVE-2015-1268)

VULNERABILITY DETAILS Calling an object-returning static method with a cross-origin thing passed as |this| yields an object wrapped in the cross-origin scope. This is because FunctionCallbackInfo ends up with a cross-origin holder, and the holder acts as a creation context for the return value in...

Chrome Universal XSS using exceptions thrown from Object.observe (CVE-2015-1304)

VULNERABILITY DETAILS From /v8/src/object-observe.js: function ObjectObserveobject, callback, acceptList ... var objectObserveFn = %GetObjectContextObjectObserveobject; return objectObserveFnobject, callback, acceptList; From /v8/src/runtime/runtime-observe.cc:...

Chrome Universal XSS using stack overflow exceptions (CVE-2015-1303)

VULNERABILITY DETAILS When the maximum call stack size is exceeded, a RangeError object is created using isolate's current context. Thus, if a cross-origin context had been entered through the V8WrapperInstantiationScope constructor, for example, a cross-origin exception will be propagated to the...

Chrome Universal XSS using iterables (CVE-2016-1668)

VULNERABILITY DETAILS From /thirdparty/WebKit/Source/bindings/core/v8/Iterable. h: void forEachForBinding... ... v8::LocalcreationContextscriptState-context-Global; v8::Local v8Callbackthe callback. v8Value. As; v8::Localv8ThisArgmethod performs a stable. v8Value; v8::Local args3; args2 =...