1482 matches found
CVE-2020-3446 Cisco vWAAS for Cisco ENCS 5400-W Series and CSP 5000-W Series Default Credentials Vulnerability
A vulnerability in Cisco Virtual Wide Area Application Services vWAAS with Cisco Enterprise NFV Infrastructure Software NFVIS-bundled images for Cisco ENCS 5400-W Series and CSP 5000-W Series appliances could allow an unauthenticated, remote attacker to log into the NFVIS CLI of an affected devic...
Cisco vWAAS for Cisco ENCS 5400-W Series and CSP 5000-W Series Default Credentials Vulnerability
A vulnerability in Cisco Virtual Wide Area Application Services vWAAS with Cisco Enterprise NFV Infrastructure Software NFVIS-bundled images for Cisco ENCS 5400-W Series and CSP 5000-W Series appliances could allow an unauthenticated, remote attacker to log into the NFVIS CLI of an affected devic...
CVE-2020-16266
An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on viewallbugpage.php allows a remote attacker to inject arbitrary HTML into the page by saving it into a text Custom Field, leading to possible code execution in the browser of any user subsequently viewing the issue if CSP...
Google Chrome Bug Could Let Hackers Bypass CSP Protection; Update Web Browsers
If you haven't recently updated your Chrome, Opera, or Edge web browser to the latest available version, it would be an excellent idea to do so as quickly as possible. Cybersecurity researchers on Monday disclosed details about a zero-day flaw in Chromium-based web browsers for Windows, Mac and...
Google Chrome Browser Bug Exposes Billions of Users to Data Theft
A vulnerability in Google’s Chromium-based browsers would allow attackers to bypass the Content Security Policy CSP on websites, in order to steal data and execute rogue code. The bug CVE-2020-6519 is found in Chrome, Opera and Edge, on Windows, Mac and Android – potentially affecting billions of...
Exploit for CVE-2020-6519
Chromium 83 Zero Day Full CSP Bypass Cross Platforms CVE-...
BugPoC: Solution for XSS challenge calc.buggywebsite.com
Summary: http://calc.buggywebsite.com/ is a angular site designed as a calculator. After observing the source code , there is iframe frame.html with functionality of displaying the data of postmessage in the webpage. js window.addEventListener"message", receiveMessage, false; function...
Automattic: DOM-Based XSS in tumblr.com
Description Hi, i would like to report DOM-Based XSS that it's exactly like this one 882546, this one work just because the page /reblog/ID/OTHERID doesn't have a correct CSP rule. Steps to reproduce 1. go to https://www.tumblr.com/reblog/620008931446652928/JBuEvzz5 2. click in click me 3. click ...
GitLab: SafeParamsHelper::safe_params is not so safe
Summary GitLab uses SafeParamsHelper to filter out some keys before passing them to urlfor: ruby def safeparams if params.respondto?:permit! params.except:host, :port, :protocol.permit! else params end end The issue is that there are a lot more dangerous keys: ruby RESERVEDOPTIONS = :host,...
PT-2020-6884 · Apple +7 · Ipados +14
Name of the Vulnerable Software and Affected Versions: iOS versions prior to 13.6 iPadOS versions prior to 13.6 tvOS versions prior to 13.4.8 watchOS versions prior to 6.2.8 Safari versions prior to 13.1.2 iTunes versions prior to 12.10.8 for Windows iCloud for Windows versions prior to 11.3 iClo...
CVE-2020-6527
Insufficient policy enforcement in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page...
UBUNTU-CVE-2020-6519
Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page...
CVE-2020-6527
Google Chrome before 84.0.4147.89 has an Insufficient policy enforcement in CSP that could allow a remote attacker to bypass content security policy via a crafted HTML page. This CVE affects Chrome’s CSP handling and was fixed in the 84.0.4147.89 update (stable channel) and related Chromium secur...
CVE-2020-6519
CVE-2020-6519 is a policy bypass in the Content Security Policy (CSP) for Google Chrome, allowing a remote attacker to bypass CSP via a crafted HTML page in Chrome versions prior to 84.0.4147.89. Connected sources confirm public advisories and fixes across distributions: Debian notes a security u...
CVE-2020-6519
Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page...
openSUSE Security Update : chromium (openSUSE-2020-1020)
This update for chromium fixes the following issues : - Update to 84.0.4147.89 boo1174189 : - Critical CVE-2020-6510: Heap buffer overflow in background fetch. - High CVE-2020-6511: Side-channel information leakage in content security policy. - High CVE-2020-6512: Type Confusion in V8. - High...
salleurl.edu Cross Site Scripting vulnerability OBB-1211027
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Hackers Using Google Analytics to Bypass Web Security and Steal Credit Cards
Researchers reported on Monday that hackers are now exploiting Google's Analytics service to stealthily pilfer credit card information from infected e-commerce sites. According to several independent reports from PerimeterX, Kaspersky, and Sansec, threat actors are now injecting data-stealing cod...
Nextcloud: Reflected XSS when renaming a file with a vulnerable name which results in an error
Hi, It looks like Nextcloud team will accept the XSS protected by the CSP. Report 896511 Here is another XSS. 1. Rename an existing filename to .jpg. 2. Anyone tries to rename this .jpg with an invalid filename, like add a "" in it, will trigger the XSS attack. 3. Need bypass the CSP. Thanks...
Nextcloud: XSS in image metadata field
Hi, Will you confirm the XSS vulnerability blocked by the CSP? On Nextcloud 19.0.0 1. Upload the PoC.jpg 2. Check the PoC.jpg metadata 3. Need bypass the CSP to trigger it Impact Cross-Site Scripting...