358 matches found
DEBIAN-CVE-2015-3295
markdown-it before 4.1.0 does not block data: URLs...
UBUNTU-CVE-2017-5466
If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will run the reloaded "data:text/html" page with its origin set incorrectly. This allows for a cross-site scripting XSS attack. This vulnerability affects Thunderbi...
CVE-2017-7188
Zurmo 3.1.1 Stable allows a Cross-Site Scripting XSS attack with a base64-encoded SCRIPT element within a data: URL in the returnUrl parameter to default/toggleCollapse...
Cross site scripting
Zurmo 3.1.1 Stable allows a Cross-Site Scripting XSS attack with a base64-encoded SCRIPT element within a data: URL in the returnUrl parameter to default/toggleCollapse...
Mozilla: Restricted external resources can be loaded by SVG images through data URLs (MFSA 2016-94, MFSA 2016-95)
External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs. This could allow for cross-domain data leakage. This vulnerability affects Firefox 50.1, Firefox ESR 45.6, and Thunderbird 45.6...
Security update for MozillaFirefox (important)
MozillaFirefox is updated to version 50.0.2 which fixes the following issues: Firefox crashed with 3rd party Chinese IME when using IME text fixed in version 50.0.1 Redirection from an HTTP connection to a data: URL could inherit wrong origin after an HTTP redirect fixed in version 50.0.1,...
Mozilla Firefox Security Advisories (MFSA2016-91, MFSA2016-91) - Windows
Mozilla Firefox is prone to an URL redirection vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...
CVE-2016-9078
Redirection from an HTTP connection to a "data:" URL assigns the referring site's origin to the "data:" URL in some circumstances. This can result in same-origin violations against a domain if it loads resources from malicious sites. Cross-origin setting of cookies has been demonstrated without t...
UBUNTU-CVE-2016-9078
Redirection from an HTTP connection to a "data:" URL assigns the referring site's origin to the "data:" URL in some circumstances. This can result in same-origin violations against a domain if it loads resources from malicious sites. Cross-origin setting of cookies has been demonstrated without t...
FreeBSD : mozilla -- data: URL can inherit wrong origin after an HTTP redirect (f90fce70-ecfa-4f4d-9ee8-c476dbf4bf0e)
The Mozilla Foundation reports : Redirection from an HTTP connection to a data: URL assigns the referring site's origin to the data: URL in some circumstances. This can result in same-origin violations against a domain if it loads resources from malicious sites. Cross-origin setting of cookies ha...
mozilla -- data: URL can inherit wrong origin after an HTTP redirect
The Mozilla Foundation reports: Redirection from an HTTP connection to a data: URL assigns the referring site's origin to the data: URL in some circumstances. This can result in same-origin violations against a domain if it loads resources from malicious sites. Cross-origin setting of cookies has...
Security vulnerabilities fixed in Firefox 50.0.1 — Mozilla
Redirection from an HTTP connection to a data: URL assigns the referring site's origin to the data: URL in some circumstances. This can result in same-origin violations against a domain if it loads resources from malicious sites. Cross-origin setting of cookies has been demonstrated without the...
KLA10909 Security vulnerabilitity in Mozilla Firefox
An unspecified vulnerability was found in Mozilla Firefox 49 and 50. It can be exploited to gain priveleges. Technical details Redirection from HTTP connection to a data:URL assigns the referring of site origin to the data: URL in some cases. Because of that same-origin violations against a domai...
WebSummit: Reflected xss on websummit.net
Hey guys, TL;DR: Reflected XSS on websummit.net/attendees/featured-attendees as the q parameter is directly reflecting special characters in the data-url on the handlebars template section of the page, as opposed to URL encoding them. Proof of Concept: Visit...
TYPO3 'data:' URL Scheme Cross-Site Scripting Vulnerability
TYPO3 is a free and open source content management system maintained by the Swiss TYPO3 Association. A cross-site scripting vulnerability exists in TYPO3. Because the program fails to properly filter user-supplied input, an attacker may be able to exploit the vulnerability to execute arbitrary...
CVE-2016-5251
Mozilla Firefox before 48.0 allows remote attackers to spoof the location bar via crafted characters in the media type of a data: URL...
CVE-2016-5251
Mozilla Firefox before 48.0 allows remote attackers to spoof the location bar via crafted characters in the media type of a data: URL...
Code injection
Mozilla Firefox before 48.0 allows remote attackers to spoof the location bar via crafted characters in the media type of a data: URL...
