UBUNTU-CVE-2020-12391

Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. This vulnerability affects Firefox 76...

csp-france.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1151049 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting csp-france.com website an...

Insecure HTTP Headers

firefox is vulnerable to insecure HTTP headers. The vulnerability exists as a flaw was found in the way Firefox handled pages with multiple Content Security Policy CSP headers. This could lead to a cross-site scripting attack if used in conjunction with a website that has a header injection flaw...

Google Chrome Security Bypass Vulnerability (CNVD-2020-31534)

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Google Chrome prior to version 81.0.4044.92, which stems from insufficient policy enforcement. A remote attacker can exploit the vulnerability to bypass content security policies via specially...

CVE-2020-9055

Versiant LYNX CSP 3.5.2 is vulnerable to stored cross-site scripting due to insufficient input validation, enabling a local, authenticated attacker to inject JavaScript that is stored and executed for end users (possible redirects, session cookie hijacking, information disclosure). The issue is d...

CVE-2019-15539

The CVE-2019-15539 entry concerns MantisBT before version 2.21.3, affecting the proj_doc_edit_page.php Project Documentation feature. The vulnerability is a stored XSS flaw triggered when uploading an attachment with a crafted filename; the injected script is executed when editing the document pa...

CVE-2019-15539

The projdoceditpage.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting XSS vulnerability, allowing execution of arbitrary code if CSP settings permit it after uploading an attachment with a crafted filename. The code is executed when editing the document...

GitLab: Stored XSS in blob viewer

Summary I found a Stored-XSS in blob viewer when viewing a json file. In particular, when viewing an openapi file, openapiviewer is called to transfer the file's data to SwaggerUIBundle to render. SwaggerUIBundle does its job when rending graphical representation of the openapi's content. It also...

PayPal: Reflect XSS and CSP Bypass on https://www.paypal.com/businesswallet/currencyConverter/

An endpoint used for currency conversion was found to suffer from a reflected XSS vulnerability, where user input was not being properly sanitized in a parameter in the URL. This could lead to a malicious user injecting malicious JavaScript, HTML, or any other type of code that the browser may...

chromium-browser: Insufficient policy enforcement in CSP

Insufficient policy enforcement in CSP in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML page...

CVE-2020-6391

CVE-2020-6391 concerns Blink in Google Chrome. The vulnerability arises from insufficient validation of untrusted input in Blink, allowing a local attacker to bypass Content Security Policy via a specially crafted HTML page on Chrome versions prior to 80.0.3987.87. Affected product: Google Chrome...

Clario: Multiple Links Vulnerable to Reflected xss

Summary Multiple Links Vulnerable to Reflected xss in https://mackeeper.com/mk/de/ Steps to reproduce goto these links and xss will be triggered...

KLA11660 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, obtain sensitive information, cause denial of service, spoof user interface. Below is a complete list of vulnerabilities: 1. A...

USN-4234-2 firefox regressions

USN-4234-1 fixed vulnerabilities in Firefox. The update introduced various minor regressions. This update fixes the problems. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafte...

h1-ctf: [h1-415 2020] Chain of vulnerabilities leading to account takeover and unauthorized access of sensitive internal resources

Note: Please read this report as "An attacker taking over a customer's account" and not as "helping Jobert recovering his document" : Summary: Chaining following issues let's an attacker access sensitive information, 1. Exposure of customer email and regex logic error leading to account takeover ...

GHSA-XQ52-RV6W-397C Directive injection when using dynamic overrides with user input

Impact If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in...

h1-ctf: [h1-415 2020] @_bayotop h1-415-ctf writeup

TL;DR: Thanks for the challenge! 1. Abusing account recovery via QR codes to get access to [email protected]. 2. Blind XSS in /support/review/ including CSP bypass. 3. Missing input sanitization on name parameter when POSTing to /support/review/. 4. Access to remote debugging port on local...

h1-ctf: [h1-415 2020] My writeup on how to retrieve the special secret document

Summary: An attacker without any privilege is able to retrieve the special secret document, hosted on the https://h1-415.h1ctf.com website. To do so, multiple steps are required : 1. The authentication must be bypassed to have a licensed account; 2. The support team portal is vulnerable to a blin...

CVE-2019-17001

CVE-2019-17001 describes a CSP bypass in Firefox where an object tag can bypass the page's CSP to execute JavaScript in the protected document. The issue affected Firefox 69 and was not present in earlier versions; it affects Firefox

CVE-2019-17002

CVE-2019-17002 affects Mozilla Firefox versions before 70.0. If upgrade-insecure-requests is set in the Content Security Policy and a link is dragged and dropped from that page, the link is not upgraded to https, exposing users to potential security bypass and stability issues. The primary impact...