Design/Logic Flaw

An issue was discovered in Ignite Realtime Spark 2.8.3 and the ROAR plugin for it on Windows. A chat message can include an IMG element with a SRC attribute referencing an external host's IP address. Upon access to this external host, the NTLM hashes of the user are sent with the HTTP request. Th...

Mail.ru: molotok.m.mail.ru delegated to external entity

SDC bypass secure cookies access vulnerability in m.mail.ru due to subdomain name pointing to uncontrolled external host...