Tor: Tor Browser: iframe with `data:` uri has access to parent window

Version: 7.5.4 based on Mozilla Firefox 52.8.0 Tested with standard security slider. However, it's likely to be possible with a higher security level. Summary In Tor Browser iframe with data:uri inherits the origin of parent window. That leads to iframe has access to parent window. PoC Iframe cou...

CVE-2016-10712

In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of streamgetmetadata can be controlled if the input can be controlled e.g., during file uploads. For example, a "$uri = streamgetmetadatafopen$file, "r"'uri'" call mishandles the case where $file is...

UBUNTU-CVE-2016-10712

In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of streamgetmetadata can be controlled if the input can be controlled e.g., during file uploads. For example, a "$uri = streamgetmetadatafopen$file, "r"'uri'" call mishandles the case where $file is...

Design/Logic Flaw

marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser...

CVE-2017-1000427

marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser...

CVE-2017-1000427

marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser...

UBUNTU-CVE-2017-1000427

marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser...

DEBIAN-CVE-2017-1000427

marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser...

CVE-2017-1000427

marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser...

CVE-2017-1000427

CVE-2017-1000427: Marked up to version 0.3.6 and earlier is vulnerable to cross-site scripting via the data: URI parser. This is an XSS in user-supplied input that can execute script in the victim’s browser when a crafted URL is clicked. The NVD shows CVSS v3.0 base score 6.1 (network, low attack...

CVE-2017-1000427

marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser...

Mac OS X Local Javascript Quarantine Bypass

Advisory ID: SGMA17-002 Title: Mac OS X Local Javascript Quarantine Bypass Product: Mac OS X Version: 10.12, 10.11, 10.10 and probably prior Vendor: apple.com Type: DOM Based XSS Risk level: 3 / 5 Credits: [email protected] CVE: N/A Vendor notification: 2017-07-27 Vendor fix:...

Mac OS X Local Javascript Quarantine Bypass youtube Vulnerability

Exploit for macOS platform in category local exploits Details Mac OS X contains a vulnerability that allows the bypass of the Apple Quarantine and the execution of arbitrary Javascript code without restrictions. Basically, Apple's Quarantine works by setting an extended attribute to downloaded...

LFiFreak - An automated LFi Exploiter with Bind/Reverse Shells

LFiFreak is a tool for exploiting local file inclusions using PHP Input, PHP Filter and Data URI methods. Features Works with Windows, Linux and OS X Includes bind and reverse shell for both Windows and Linux Written in Python 2.7 Dependencies BeautifulSoup Download LFiFreak...

Apple Mac OS X + Safari - Local Javascript Quarantine Bypass

Apple Mac OS X + Safari - Local Javascript Quarantine Bypass Title: Mac OS X Local Javascript Quarantine Bypass Product: Mac OS X Version: 10.12, 10.11, 10.10 and probably prior Vendor: apple.com Type: DOM Based XSS Risk level: 3 / 5 Credits: [email protected] CVE: N/A Vendor...

CVE-2017-11195

Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi. The helpLaunchPage parameter is reflected in an IFRAME element, if the value contains two quotes. It properly sanitizes quotes and tags, so one cannot simply close the src with a quote and inject after that. However, an attacker can...

Cross-site Scripting (XSS)

Overview marked is a markdown parser and compiler used for rendering markdown content to html. Affected versions of the package allowed the use of data: URIs for all mime types by default potentially opening a door for Cross-site Scripting XSS attacks. Data URIs enable embedding small files in li...

Firefox - SVG cross domain cookie vulnerability （CVE-2016-9078）

Original link: http://insert-script.blogspot.jp/2016/12/firefox-svg-cross-domain-cookie.html Author: the Alex Inführ Translation: Holic know Chong Yu 404 Safety laboratory , this article has additions and changes Note: the vulnerability only affects Firefox 49 and 50 version, details see the...

Mozilla Firefox Same-Origin Policy Bypass Vulnerability (CNVD-2016-04001)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 47.0, which stems from the creation of an invalid data: URI that allows the program to allow the location.host property to be...

Partial same-origin-policy through setting location.host through data URI — Mozilla

Security researcher Armin Ebert reported that the location.host property can be set to an arbitrary string after creating an invalid data: URI. This allows for a bypass of some same-origin policy protections. This issue is mitigated by the data: URI in use and any same-origin checks for http: or...