6294 matches found
A Google Docs Bug Could Have Allowed Hackers See Your Private Documents
Google has patched a bug in its feedback tool incorporated across its services that could be exploited by an attacker to potentially steal screenshots of sensitive Google Docs documents simply by embedding them in a malicious website. The flaw was discovered on July 9 by security researcher Sreer...
Cross-site Scripting (XSS)
intelliants/subrion is vulnerable to cross-site scripting XSS. The vulnerability exists through an iframe injection through the page content block in the Add a Page section...
Navigation Restriction Bypass
chromium is vulnerable to Navigation Restriction Bypass. Inappropriate implementation in iframe sandbox in Google Chrome allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...
Authorization Bypass
firefox is vulnerable to authorization bypass. The vulnerability exists through HTTPS pages embedded in a HTTP page, a service worker registered for the former could have intercepted the request for the secure page despite the iframe not being a secure context due to the insecure framing...
UBUNTU-CVE-2020-26976
When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the insecure framing. This vulnerability affects Firefox 84...
PT-2020-16588
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 84 Description The issue occurs when a HTTPS page is embedded in a HTTP page and a service worker is registered for the secure page. In such cases, the service worker could intercept the request for the secure page,...
NewStart CGSL CORE 5.05 / MAIN 5.05 : doxygen Vulnerability (NS-SA-2020-0107)
The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has doxygen packages installed that are affected by a vulnerability: - Insufficient sanitization of the query parameter in templates/html/searchopensearch.php could lead to reflected cross-site scripting or iframe injection...
NewStart CGSL CORE 5.04 / MAIN 5.04 : doxygen Vulnerability (NS-SA-2020-0073)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has doxygen packages installed that are affected by a vulnerability: - Insufficient sanitization of the query parameter in templates/html/searchopensearch.php could lead to reflected cross-site scripting or iframe injection...
Zabbix 5.0.0 - Stored XSS via URL Widget Iframe
Exploit Title: Zabbix 5.0.0 - Stored XSS via URL Widget Iframe Date: 8/11/2020 Exploit Author: Shwetabh Vishnoi Vendor Homepage: https://www.zabbix.com/ Software Link: https://www.zabbix.com/download Affected Version: Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before...
Nextcloud: Clickjacking URLS
Hey Team While performing security testing of your websites i have found the vulnerability called Clickjacking. Many URLS are in scope and vulnerable to Clickjacking. The server didn't return an X-Frame-Options header which means that this website could be at risk of a clickjacking attack. The...
RHEL 7 : firefox (RHSA-2020:4080)
The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4080 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...
Mozilla Firefox 安全漏洞
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 83, which stems from the fact that a cross-domain iframe containing a login form may have been recognized and populated by the login...
UBUNTU-CVE-2020-26962
Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated. This could have been used in clickjacking attacks, as well as be read across partitions in dynamic first party isolation. This vulnerability affects Firefox 83...
Oracle Linux 8 : GNOME (ELSA-2020-4451)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4451 advisory. - Backport fix for CVE-2020-15503 from Fedora Resolves: 1853529 libsoup Tenable has extracted the preceding description block directly from the Oracle...
BugPoC: [BugPOC and Amazon XSS CTF writeup] A CSP Bypass Story
Summary/Description: There were quite multiple restrictions imposed while executing JavaScript on the website. I have divided them into three segments which are explained below Bypassing the iframe loading restriction The URL https://wacky.buggywebsite.com/frame.html?param=Hello,%20World when...
Apple macOS Catalina Access Control Error Vulnerability
Apple macOS Catalina is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in versions of macOS Catalina prior to 10.15.1, which stems from a cross-origin issue with the iframe element, whereby a malicious HTML document may render an iframe...
webkitgtk: Violation of iframe sandboxing policy
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1, iOS 13. Maliciously crafted web content may violate iframe sandboxing policy...
PT-2020-6490
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 91.0.4472.77 Description The issue is related to insufficient policy enforcement in the PopupBlocker component of Google Chrome, allowing a remote attacker to bypass navigation restrictions. This can be achieved...
Amazon Linux 2 : doxygen (ALAS-2020-1508)
The version of doxygen installed on the remote host is prior to 1.8.5-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1508 advisory. Insufficient sanitization of the query parameter in templates/html/searchopensearch.php could lead to reflected cross-site scriptin...