WebKit - UXSS Using JavaScript: URI and Synchronous Page Loads Exploit

VULNERABILITY DETAILS void DocumentWriter::replaceDocumentconst String& source, Document ownerDocument ... beginmframe-document-url, true, ownerDocument; // 1 // begin might fire an unload event, which will result in a situation where no new document has been attached, // and the old document has...

WebKit - UXSS Using JavaScript: URI and Synchronous Page Loads

VULNERABILITY DETAILS void DocumentWriter::replaceDocumentconst String& source, Document ownerDocument ... beginmframe-document-url, true, ownerDocument; // 1 // begin might fire an unload event, which will result in a situation where no new document has been attached, // and the old document has...

VulnCheck KEV: CVE-2019-8771

This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1, iOS 13. Maliciously crafted web content may violate iframe sandboxing policy...

CVE-2019-1975

A vulnerability in the web-based interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack on an affected device. This vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerabilit...

Hardcoded credentials

A vulnerability in the web-based interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack on an affected device. This vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerabilit...

CVE-2019-1975 Cisco HyperFlex Software Cross-Frame Scripting Vulnerability

A vulnerability in the web-based interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack on an affected device. This vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerabilit...

CVE-2019-1975 Cisco HyperFlex Software Cross-Frame Scripting Vulnerability

A vulnerability in the web-based interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack on an affected device. This vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerabilit...

Cisco HyperFlex Software Cross-Frame Scripting Vulnerability

A vulnerability in the web-based interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack on an affected device. This vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerabilit...

Cross site scripting

In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting XFS attack through the EDIT MY PROFILE feature...

CVE-2019-16193

CVE-2019-16193 affects ArcGIS Enterprise 10.6.1. A crafted IFRAME can trigger a Cross Frame Scripting (XFS) attack via the EDIT MY PROFILE feature. Public records (NVD) cite CVSS v2 base 3.5 (LOW) and CVSS v3.1 base 5.4 (MEDIUM); attack vector: NETWORK, user interaction required (CVSS3.1), and pa...

CVE-2019-16193

In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting XFS attack through the EDIT MY PROFILE feature...

CVE-2019-16193: Improper Neutralization of Input During Web Page Generation

In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting XFS attack through the EDIT MY PROFILE feature...

PT-2019-16430 · Google · Google Chrome

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 77.0.3865.75 Description: The issue is related to an inappropriate implementation in iframe, allowing a remote attacker to potentially perform a sandbox escape via a crafted HTML page. The severity of this issu...

CVE-2019-15499

CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL...

Cross site scripting

CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL...

CVE-2019-15499

CVE-2019-15499 affects CodiMD 1.3.1. In Safari, an XSS can be triggered via an IFRAME element with allow-top-navigation in the sandbox attribute when used with a data: URL. Multiple sources (NVD, Red Hat advisory, OSV, CVE lists) corroborate this description. No explicit patch/version remediation...

CVE-2019-15499

CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL...

PT-2019-14227

Name of the Vulnerable Software and Affected Versions CodiMD version 1.3.1 Description The issue allows for XSS via an IFRAME element with the allow-top-navigation attribute in the sandbox, in conjunction with a data: URL, specifically when using the Safari browser. Recommendations For CodiMD...

CVE-2019-15499: Improper Neutralization of Input During Web Page Generation

CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL...

McAfee Web Gateway Input Validation Error Vulnerability

McAfee Web Gateway MWG is a security gateway product from McAfee USA. The product provides threat protection, application control, and data loss prevention. An input validation error vulnerability exists in the administrator web console in McAfee MWG versions 7.8.2.x prior to 7.8.2.12, which can ...