Microsoft Edge Security Bypass Vulnerability (CNVD-2018-11934)

Microsoft Edge is Microsoft's built-in browser in its latest operating system, Windows 10. A security bypass vulnerability exists in Microsoft Edge. The vulnerability stems from Edge failing to properly handle requests from different sources. An attacker could exploit the vulnerability to bypass...

Hapi CORS Rewrite Vulnerability

Hapi is a server framework for Node.js. The framework supports input validation, caching, and authentication. A security vulnerability exists in Hapi versions prior to 11.0.0, which stems from the program failing to implement CORS correctly.An attacker can exploit this vulnerability to potentiall...

Microsoft Edge Security Feature Bypass Vulnerability (CNVD-2018-10732)

Microsoft Windows 10 and Windows Server 2016 are both products of Microsoft Corporation.Microsoft Windows 10 is a set of operating systems for personal computers.Windows Server 2016 is a set of server operating systems.Edge is one of the a default browser that comes with the system. A security...

Security feature bypass

Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows a security feature bypass, due to how Edge handles different-origin requests, aka "Microsoft Edge Security Feature Bypass"...

EUVD-2018-1579

Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows a security feature bypass, due to how Edge handles different-origin requests, aka "Microsoft Edge Security Feature Bypass"...

CVE-2018-0771

Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows a security feature bypass, due to how Edge handles different-origin requests, aka "Microsoft Edge Security Feature Bypass"...

CVE-2017-11833

Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to determine the origin of all webpages in the affected browser, due to how Microsoft Edge handles cross-origin requests, aka "Microsoft Edge Information...

CVE-2017-11833

Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to determine the origin of all webpages in the affected browser, due to how Microsoft Edge handles cross-origin requests, aka "Microsoft Edge Information...

Microsoft Edge Information Disclosure Vulnerability

An information disclosure vulnerability exists in the way that Microsoft Edge handles cross-origin requests. An attacker who successfully exploited this vulnerability could determine the origin of all webpages in the affected browser. In a web-based attack scenario, an attacker could host a websi...

Apache Wicket CSRF Vulnerability

Apache Wicket is the United States Apache Apache Software Foundation , a set of open source , lightweight , component-based framework , which provides an object-oriented way to develop Web-based dynamic UI applications . A security vulnerability exists in Apache Wicket versions 6.x prior to 6.25....

Cross site request forgery (csrf)

Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided...

Microsoft Edge Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins. The vulnerability allows Microsoft Edge to bypass Same-Origin Policy SOP restrictions, and to allow requests that should otherwise be ignored. An attacker who successfully exploite...

ceph: Object Gateway server DoS by sending invalid cross-origin HTTP request

A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unauthenticated attacker could use this flaw to cause denial of service by sending a specially-crafted cross-origin HTTP request...

ceph: Object Gateway server DoS by sending invalid cross-origin HTTP request

A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unauthenticated attacker could use this flaw to cause denial of service by sending a specially-crafted cross-origin HTTP request...

ceph: Object Gateway server DoS by sending invalid cross-origin HTTP request

A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unauthenticated attacker could use this flaw to cause denial of service by sending a specially-crafted cross-origin HTTP request...

PT-2016-7784 · Red Hat +1 · Ceph +1

Name of the Vulnerable Software and Affected Versions: Ceph versions 1.3.x through 2.x Description: A flaw in Ceph Object Gateway's processing of cross-origin HTTP requests can cause a denial of service when the CORS policy allows origin on a bucket. This can be exploited by a remote...

CVE-2016-3291

Microsoft Internet Explorer 11 and Microsoft Edge mishandle cross-origin requests, which allows remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."...

Microsoft Internet Explorer Multiple Vulnerabilities (3183038)

This host is missing a critical security update according to Microsoft Bulletin MS16-104. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Microsoft Edge Multiple Vulnerabilities (3183043)

This host is missing a critical security update according to Microsoft Bulletin MS16-105 SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

AirDroid Web Application Hijacking Vulnerability Patched

AirDroid has patched an authentication flaw in its web application that could allow an attacker to remotely control and manipulate a victim’s Android device. AirDroid, which is similar to Apple’s native iMessage app, allows a user to send SMS messages, make calls, add contacts and more via a...