Partial same-origin-policy through setting location.host through data URI — Mozilla

Security researcher Armin Ebert reported that the location.host property can be set to an arbitrary string after creating an invalid data: URI. This allows for a bypass of some same-origin policy protections. This issue is mitigated by the data: URI in use and any same-origin checks for http: or...

Mozilla: Cross-site reading attack through data: and view-source: URIs (MFSA 2015-149)

Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-source: URIs...

Updated thunderbird packages fix security vulnerabilities

Updated thunderbird packages fix security vulnerabilities: Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird...

CVE-2015-7211

Mozilla Firefox before 43.0 mishandles the number sign character in a data: URI, which allows remote attackers to spoof web sites via unspecified vectors...

Design/Logic Flaw

Mozilla Firefox before 43.0 mishandles the number sign character in a data: URI, which allows remote attackers to spoof web sites via unspecified vectors...

CVE-2015-7211

CVE-2015-7211 (Mozilla Firefox): Firefox before 43.0 mishandles the # character in data: URIs, allowing remote attackers to spoof websites via unspecified vectors. Affected: Mozilla Firefox before 43.0. Root cause: parsing/handling issue in data: URIs leading to spoofing. Impact: potential user d...

CVE-2015-7211

Mozilla Firefox before 43.0 mishandles the number sign character in a data: URI, which allows remote attackers to spoof web sites via unspecified vectors...

UBUNTU-CVE-2015-7211

Mozilla Firefox before 43.0 mishandles the number sign character in a data: URI, which allows remote attackers to spoof web sites via unspecified vectors...

Hash in data URI is incorrectly parsed — Mozilla

Security researcher Abdulrahman Alqabandi reported that when a data: URI is parsed, the hash '' symbol is incorrectly handled, allowing for spoofing attacks. This issue could result in the wrong URI being displayed as a location, which can mislead users to believe they are on a different site tha...

Cross-site reading attack through data and view-source URIs — Mozilla

Security researcher Tsubasa Iinuma reported a mechanism to violate same-origin policy to content using data: and view-source: URIs to confuse protections and bypass restrictions. This resulted in the ability to read data from cross-site URLs and local files...

CVE-2015-5956

The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting XSS attacks via a base64 encoded data URI, as demonstrated by the 1 returnUrl parameter to showrechis.php and...

Cross site scripting

The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting XSS attacks via a base64 encoded data URI, as demonstrated by the 1 returnUrl parameter to showrechis.php and...

CVE-2015-3012

Multiple cross-site scripting XSS vulnerabilities in WebODF before 0.5.5, as used in ownCloud, allow remote attackers to inject arbitrary web script or HTML via a 1 style or 2 font name or 3 javascript or 4 data URI...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in WebODF before 0.5.5, as used in ownCloud, allow remote attackers to inject arbitrary web script or HTML via a 1 style or 2 font name or 3 javascript or 4 data URI...

MediaWiki Incomplete Blacklist Vulnerability (CNVD-2015-02418)

MediaWiki is a Wiki program. An incomplete blacklist vulnerability exists in the includes/upload/UploadBase.php script of MediaWiki. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of nested SVG files with data: URI of type pplication/xml MIME...

CVE-2015-2931

Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI...

CVE-2015-2931

Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI...

CVE-2015-2931

MediaWiki is affected by CVE-2015-2931 due to an Incomplete blacklist vulnerability in includes/upload/UploadBase.php. A remote attacker can inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI. Affected versions include MediaWiki before 1.19.24, ...

CVE-2015-2931

Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI...

Apple Safari 1.x/2.0.1 Data URI Memory Corruption Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14868/info Apple Safari is prone to a memory corruption vulnerability. This issue is exposed when the browser opens specific 'data:' URIs, causing the browser to crash. Though unconfirmed, this vulnerability could be...