CVE-2015-7184

The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin...

Cross site scripting

The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin...

UBUNTU-CVE-2015-7184

The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin...

CVE-2015-7184

The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin...

CVE-2015-7184

The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin...

CVE-2015-7184: Improper Access Control

The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin...

Google Chrome Blink Same-Origin Policy Bypass Vulnerability (CNVD-2015-06764)

Google Chrome is an open source WEB browser. Google uses Blink in the Cascading Style Sheets CSS implementation of the core/css/CSSFontFaceSrcValue.cpp file in the 'CSSFontFaceSrcValue::fetch ' function in the core/css/css/CSSFontFaceSrcValue.cpp file contains a security vulnerability that can be...

USN-2768-1 firefox vulnerability

Abdulrahman Alqabandi and Ben Kelly discovered that the fetch API did not correctly implement the Cross Origin Resource Sharing CORS specification. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information from oth...

USN-2768-1: Firefox vulnerability

Abdulrahman Alqabandi and Ben Kelly discovered that the fetch API did not correctly implement the Cross Origin Resource Sharing CORS specification. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information from oth...

Firefox < 41.0.2 'fetch' API Cross-Origin Bypass

The version of Firefox installed on the remote Windows host is prior to 41.0.2. It is, therefore, affected by a cross-origin restriction bypass vulnerability in the fetch API due to an incorrect implementation of the Cross-Origin Resource Sharing CORS specification. A remote attacker can exploit...

firefox: cross-origin restriction bypass

Security researcher Abdulrahman Alqabandi reported that the fetch API did not correctly implement the Cross-Origin Resource Sharing CORS specification, allowing a malicious page to access private data from other origins. Mozilla developer Ben Kelly independently reported the same issue...

Firefox < 41.0.2 'fetch' API Cross-Origin Bypass (Mac OS X)

The version of Firefox installed on the remote Mac OS X host is prior to 41.0.2. It is, therefore, affected by a cross-origin restriction bypass vulnerability in the fetch API due to an incorrect implementation of the Cross-Origin Resource Sharing CORS specification. A remote attacker can exploit...

CVE-2015-6762

The CSSFontFaceSrcValue::fetch function in core/css/CSSFontFaceSrcValue.cpp in the Cascading Style Sheets CSS implementation in Blink, as used in Google Chrome before 46.0.2490.71, does not use the CORS cross-origin request algorithm when a font's URL appears to be a same-origin URL, which allows...

CVE-2015-6762: Undefined Security Weakness

The CSSFontFaceSrcValue::fetch function in core/css/CSSFontFaceSrcValue.cpp in the Cascading Style Sheets CSS implementation in Blink, as used in Google Chrome before 46.0.2490.71, does not use the CORS cross-origin request algorithm when a font's URL appears to be a same-origin URL, which allows...

PT-2015-2401

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 46.0.2490.71 Opera affected versions not specified Description The issue is related to the CSSFontFaceSrcValue::fetch function in the Cascading Style Sheets CSS implementation in Blink. This function does not us...

PT-2015-7474

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 41.0.2 Description The issue concerns the implementation of the fetch API in Mozilla Firefox, where access to the HTTP response body is not properly restricted in certain situations. This occurs when user...

Cross-origin restriction bypass using Fetch — Mozilla

Security researcher Abdulrahman Alqabandi reported that the fetch API did not correctly implement the Cross-Origin Resource Sharing CORS specification, allowing a malicious page to access private data from other origins. Mozilla developer Ben Kelly independently reported the same issue...

firefox -- Cross-origin restriction bypass using Fetch

Firefox Developers report: Security researcher Abdulrahman Alqabandi reported that the fetch API did not correctly implement the Cross-Origin Resource Sharing CORS specification, allowing a malicious page to access private data from other origins. Mozilla developer Ben Kelly independently reporte...

Dragging and dropping images exposes final URL after redirects — Mozilla

Security researcher Mario Gomes reported that when a previously loaded image on a page is drag and dropped into content after a redirect, the redirected URL is available to scripts. This is a violation of the Fetch specification's defined behavior for "Atomic HTTP redirect handling" which states...

PT-2015-6942

Name of the Vulnerable Software and Affected Versions Views module versions 7.x-3.5 through 7.x-3.10 for Drupal Description The issue concerns the views fetch data method in the Views module for Drupal, which fails to rebuild the full cache if the static cache is not empty. This allows remote...