Use the csrf vulnerability to upload files-the vulnerability warning-the black bar safety net

Everyone knows that the commonly used csrf to upload a file is not very simple. The problem is that we create a fake form submission data with browser file upload to submit the data a little different. That is the upload request will have a filename parameter: -----------------------------2 5 6 6...

Same-origin bypass with web workers and XMLHttpRequest — Mozilla

Mozilla community member Federico Lanusse reported a mechanism where a web worker can violate same-origin policy and bypass cross-origin checks through XMLHttpRequest. This could allow for cross-site scripting XSS attacks by web workers...

Google Chrome < 28.0.1500.95 Multiple Vulnerabilities

Binary data 6961.pasl...

Google Chrome < 28.0.1500.95 Multiple Vulnerabilities

Binary data 801428.prm...

Google Chrome < 28.0.1500.95 Multiple Vulnerabilities

The version of Google Chrome installed on the remote host is a version prior to 28.0.1500.95. It is, therefore, affected by multiple vulnerabilities : - A cross-origin restriction bypass error exists related to HTML frames. CVE-2013-2881 - A type-confusion error exists in the V8 JavaScript engine...

cors_origin

Inspect if application check that the value of the "Origin" HTTP header is consistent with the value of the remote IP address/Host of the sender of the incoming HTTP request. Configurable parameters are: originheadervalue Note : This plugin is useful to test "Cross Origin Resource Sharing CORS"...

Google Chrome < 27.0.1453.110 Multiple Vulnerabilities

Binary data 801017.prm...

Google Chrome < 27.0.1453.110 Multiple Vulnerabilities

Binary data 6858.pasl...

FreeBSD : chromium -- multiple vulnerabilities (4865d189-cd62-11e2-ae11-00262d5ed8ee)

Google Chrome Releases reports : 242322 Medium CVE-2013-2855: Memory corruption in dev tools API. Credit to 'daniel.zulla'. 242224 High CVE-2013-2856: Use-after-free in input handling. Credit to miaubiz. 240124 High CVE-2013-2857: Use-after-free in image handling. Credit to miaubiz. 239897 High...

Google Chrome < 27.0.1453.110 Multiple Vulnerabilities

The version of Google Chrome installed on the remote host is a version prior to 27.0.1453.110 and is, therefore, affected by the following vulnerabilities : - An error exists related to the renderer and bad handles. CVE-2013-2854 - Errors exist related to dev tools API, Skia GPU handling and SSL...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 242322 Medium CVE-2013-2855: Memory corruption in dev tools API. Credit to "daniel.zulla". 242224 High CVE-2013-2856: Use-after-free in input handling. Credit to miaubiz. 240124 High CVE-2013-2857: Use-after-free in image handling. Credit to miaubiz. 239897 High...

Stable Channel Update

The Stable channel has been updated to 27.0.1453.110 for Windows, Macintosh, Linux and Chrome Frame platforms. Security fixes and rewards: Please see the Chromium security page for more information. Note that the referenced bugs may be kept private until a majority of our users are up to date wit...

CVE-2013-0939

EMC Documentum Webtop before 6.7 SP2, Documentum WDK before 6.7 SP2, Documentum Taskspace before 6.7 SP2, and Documentum Records Manager before 6.7 SP2 allow remote attackers to obtain sensitive information via vectors involving cross-origin frame navigation, related to a "Cross Frame Scripting"...

Cross site scripting

EMC Documentum Webtop before 6.7 SP2, Documentum WDK before 6.7 SP2, Documentum Taskspace before 6.7 SP2, and Documentum Records Manager before 6.7 SP2 allow remote attackers to obtain sensitive information via vectors involving cross-origin frame navigation, related to a "Cross Frame Scripting"...

CVE-2013-0939

EMC Documentum CVE-2013-0939 affects Webtop, WDK, Taskspace, and Records Manager prior to 6.7 SP2. The issue is a Cross Frame Scripting vulnerability allowing remote attackers to obtain sensitive information via cross-origin frame navigation. Affected products include Webtop, WDK, Taskspace, and ...

CVE-2013-0939

EMC Documentum Webtop before 6.7 SP2, Documentum WDK before 6.7 SP2, Documentum Taskspace before 6.7 SP2, and Documentum Records Manager before 6.7 SP2 allow remote attackers to obtain sensitive information via vectors involving cross-origin frame navigation, related to a "Cross Frame Scripting"...

Mozilla Thunderbird 7.0 Multiple Vulnerabilities

Binary data 801281.prm...

Opera < 12.13 Multiple Vulnerabilities

The version of Opera installed on the remote host is earlier than 12.13 and is, therefore, reportedly affected by the following vulnerabilities : - An error exists related to DOM manipulation that could lead to application crashes or arbitrary code execution. 1042 - A use-after-free error exists...

CORS requests can omit the preflight request – Opera Security Advisories

Cross-Origin Resource Sharing CORS requests are required to send a preflight request if custom headers are included, to check that the host wishes to allow the full request to be made. An example of where this may be needed is for sites that use a custom header with a static value as part of thei...

Opera Multiple Vulnerabilities-03 Jan13 (Mac OS X)

The host is installed with Opera and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gboperamultvuln03jan13macosx.nasl 6093 2017-05-10 09:03:18Z teissa $ Opera Multiple Vulnerabilities-03 Jan13 Mac OS X Authors: Antu Sanadi Copyright: Copyright c 2013 Greenbone Networks GmbH...