11438 matches found
CVE-2019-1445
A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsoft Office Online Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1447...
Spoofing
A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsoft Office Online Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1447...
Spoofing
A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsoft Office Online Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1445...
CVE-2019-1445
The vulnerability CVE-2019-1445 affects Microsoft Office Online/Office Online Server, resulting from improper validation of the origin in cross-origin communication handlers. This root cause enables spoofing via cross-origin requests when Office Online handles cross-domain messages. Evidence from...
Description of the security update for Office Online Server: November 12, 2019
None None...
Microsoft Office Online Spoofing Vulnerability
A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications correctly. An attacker could exploit the vulnerability by sending a specially crafted request to an affected site. The attacker who successfully exploited the vulnerability could then perfor...
Microsoft Office Online Spoofing Vulnerability
A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications correctly. An attacker could exploit the vulnerability by sending a specially crafted request to an affected site. The attacker who successfully exploited the vulnerability could then perfor...
Security Updates for Microsoft Office Online Server (November 2019)
The Microsoft Office Online Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly. An attacker cou...
CVE-2019-14860
It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information...
Design/Logic Flaw
It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information...
CVE-2019-14860
CVE-2019-14860 affects Red Hat Fuse / Syndesis: the Syndesis CORS configuration was identified as allowing all origins, enabling potential phishing and unauthorized information access. The root cause is a default CORS policy that is too permissive for cross-origin requests. Public advisories (RHS...
CVE-2019-14860
It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information...
CVE-2019-14860
It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information...
Mozilla: document.domain-based origin isolation has same-origin-property violation
A flaw was found in Mozilla's firefox and thunderbird where if two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window. This could cause an interaction between two...
chromium-browser: Cross-context information leak
Insufficient policy enforcement in JavaScript in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
chromium-browser: Extension permission bypass
Insufficient policy enforcement in extensions in Google Chrome prior to 78.0.3904.70 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension...
chromium-browser: Cross-origin data leak
Insufficient policy enforcement in JavaScript in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
Mozilla Firefox ESR < 31.2 Multiple Vulnerabilities
Binary data 701248.prm...
WebKit - Universal XSS in JSObject::putInlineSlow and JSValue::putToPrimitive Exploit
VULNERABILITY DETAILS bool JSObject::putInlineSlowExecState exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot ASSERT!isThisValueAlteredslot, this; VM& vm = exec-vm; auto scope = DECLARETHROWSCOPEvm; JSObject obj = this; for ;; unsigned attributes; PropertyOffset offset =...