53 matches found
CVE-2024-10461
In multipart/x-mixed-replace responses, Content-Disposition: attachment in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox 132, Firefox ESR 128.4, Thunderbird 128.4, and Thunderbird 132...
CVE-2024-10461
In multipart/x-mixed-replace responses, Content-Disposition: attachment in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox 132, Firefox ESR 128.4, Thunderbird 128.4, and Thunderbird 132...
CVE-2024-10461: Improper Neutralization of Input During Web Page Generation
In multipart/x-mixed-replace responses, Content-Disposition: attachment in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox 132, Firefox ESR 128.4, Thunderbird 128.4, and Thunderbird 132...
SUSE CVE-2018-5164
Content Security Policy CSP is not applied correctly to all parts of multipart content sent with the "multipart/x-mixed-replace" MIME type. This could allow for script to run where CSP should block it, allowing for cross-site scripting XSS and other attacks. This vulnerability affects Firefox 60...
HTTP Response Splitting
perl is vulnerable to HTTP response splitting. The vulnerability exists as it was found that the Perl CGI module used a hard-coded value for the MIME boundary string in multipart/x-mixed-replace content. A remote attacker could possibly use this flaw to conduct an HTTP response splitting attack v...
CVE-2019-19916
In Midori Browser 0.5.11 on Windows 10, Content Security Policy CSP is not applied correctly to all parts of multipart content sent with the multipart/x-mixed-replace MIME type. This could result in script running where CSP should have blocked it, allowing for cross-site scripting XSS and other...
CVE-2019-19916: Improper Neutralization of Input During Web Page Generation
In Midori Browser 0.5.11 on Windows 10, Content Security Policy CSP is not applied correctly to all parts of multipart content sent with the multipart/x-mixed-replace MIME type. This could result in script running where CSP should have blocked it, allowing for cross-site scripting XSS and other...
CVE-2018-5164
Content Security Policy CSP is not applied correctly to all parts of multipart content sent with the "multipart/x-mixed-replace" MIME type. This could allow for script to run where CSP should block it, allowing for cross-site scripting XSS and other attacks. This vulnerability affects Firefox 60...
CVE-2017-5385: Exposure of Sensitive Information to an Unauthorized Actor
Data sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will ignore the referrer-policy response header, leading to potential information disclosure for sites using this header. This vulnerability affects Firefox 51...
CVE-2018-5164: Improper Neutralization of Input During Web Page Generation
Content Security Policy CSP is not applied correctly to all parts of multipart content sent with the "multipart/x-mixed-replace" MIME type. This could allow for script to run where CSP should block it, allowing for cross-site scripting XSS and other attacks. This vulnerability affects Firefox 60...
Mozilla Firefox Cross-Site Scripting Vulnerability (CNVD-2018-10239)
Mozilla Firefox browser Firefox is a free and open source browser for Windows, Linux and MacOSX platforms. A cross-site scripting vulnerability exists in Mozilla Firefox. The vulnerability arises because the Content Security Policy CSP is not properly applied to all parts of multipart content sen...
USN-2936-2: Oxygen-GTK3 update
USN-2936-1 fixed vulnerabilities in Firefox. The update caused Firefox to crash on startup with the Oxygen GTK theme due to a pre-existing bug in the Oxygen-GTK3 theme engine. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Christian Holler, Tyson...
CVE-2016-2816
Mozilla Firefox before 46.0 allows remote attackers to bypass the Content Security Policy CSP protection mechanism via the multipart/x-mixed-replace content type...
CVE-2016-2816
Mozilla Firefox before 46.0 allows remote attackers to bypass the Content Security Policy CSP protection mechanism via the multipart/x-mixed-replace content type...
Design/Logic Flaw
Mozilla Firefox before 46.0 allows remote attackers to bypass the Content Security Policy CSP protection mechanism via the multipart/x-mixed-replace content type...
CVE-2016-2816
Mozilla Firefox before 46.0 allows remote attackers to bypass the Content Security Policy CSP protection mechanism via the multipart/x-mixed-replace content type...
CVE-2016-2816
Mozilla Firefox before 46.0 allows remote attackers to bypass the Content Security Policy CSP protection mechanism via the multipart/x-mixed-replace content type...
CVE-2016-2816: Improper Access Control
Mozilla Firefox before 46.0 allows remote attackers to bypass the Content Security Policy CSP protection mechanism via the multipart/x-mixed-replace content type...
