CVE-2017-20146: Origin Validation Error

Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy...

CVE-2022-46692: Insufficient Verification of Data Authenticity

A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may bypass Same Origin Policy...

CVE-2022-4188: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Insufficient validation of untrusted input in CORS in Google Chrome on Android prior to 108.0.5359.71 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2022-3310: Client-Side Enforcement of Server-Side Security

Insufficient policy enforcement in custom tabs in Google Chrome on Android prior to 106.0.5249.62 allowed an attacker who convinced the user to install an application to bypass same origin policy via a crafted application. Chromium security severity: Medium...

CVE-2022-3310

Insufficient policy enforcement in custom tabs in Google Chrome on Android prior to 106.0.5249.62 allowed an attacker who convinced the user to install an application to bypass same origin policy via a crafted application. Chromium security severity: Medium...

CVE-2022-1867: Undefined Security Weakness

Insufficient validation of untrusted input in Data Transfer in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to bypass same origin policy via a crafted clipboard content...

CVE-2022-1499

Inappropriate implementation in WebAuthentication in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass same origin policy via a crafted HTML page...

CVE-2015-5236: Insufficient Verification of Data Authenticity

It was discovered that the IcedTea-Web used codebase attribute of the tag on the HTML page that hosts Java applet in the Same Origin Policy SOP checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value...

PT-2022-7832

Name of the Vulnerable Software and Affected Versions IcedTea-Web affected versions not specified Description The issue allows a malicious site to bypass the Same Origin Policy SOP checks via a spoofed codebase value. This is possible because the IcedTea-Web uses the codebase attribute of the tag...

PT-2022-6034

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 108.0.5359.71 Microsoft Edge affected versions not specified Description The issue is related to insufficient validation of untrusted input in CORS, allowing a remote attacker to bypass the same origin policy vi...

PT-2022-2784

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 102.0.5005.61 Description The issue exists due to insufficient validation of untrusted input in the Data Transfer component of Google Chrome. This allows a remote attacker to bypass the same origin policy via a...

Withdrawn Advisory: Node.js Inspector RCE via DNS Rebinding

Withdrawn Advisory This advisory has been withdrawn because this vulnerability affects inspector code in https://github.com/nodejs/node, not the legacy debugger at https://github.com/node-inspector/node-inspector. https://github.com/nodejs/node is not in a supported ecosystem. Original Descriptio...

PT-2022-2412

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 101.0.4951.41 Microsoft Edge affected versions not specified Description The issue is related to an inappropriate implementation in WebAuthentication, which may allow a remote attacker to bypass the same origin...

[ASA-202112-1] vivaldi: multiple issues

Arch Linux Security Advisory ASA-202112-1 ========================================= Severity: High Date : 2021-12-03 CVE-ID : CVE-2021-37981 CVE-2021-37982 CVE-2021-37984 CVE-2021-37985 CVE-2021-37986 CVE-2021-37987 CVE-2021-37988 CVE-2021-37989 CVE-2021-37990 CVE-2021-37991 CVE-2021-37992...

[ASA-202112-2] opera: multiple issues

Arch Linux Security Advisory ASA-202112-2 ========================================= Severity: High Date : 2021-12-03 CVE-ID : CVE-2021-38005 CVE-2021-38006 CVE-2021-38007 CVE-2021-38008 CVE-2021-38009 CVE-2021-38010 CVE-2021-38011 CVE-2021-38012 CVE-2021-38013 CVE-2021-38014 CVE-2021-38015...

[ASA-202111-9] chromium: multiple issues

Arch Linux Security Advisory ASA-202111-9 ========================================= Severity: High Date : 2021-11-18 CVE-ID : CVE-2021-38005 CVE-2021-38006 CVE-2021-38007 CVE-2021-38008 CVE-2021-38009 CVE-2021-38010 CVE-2021-38011 CVE-2021-38012 CVE-2021-38013 CVE-2021-38014 CVE-2021-38015...

PT-2021-5564

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 96.0.4664.45 Description The issue is related to insufficient policy enforcement in the background fetch feature, allowing a remote attacker to bypass the same origin policy. This can be achieved via a crafted...

WS-2021-0193

Handlers in versions v1.1 to v1.2.1 is allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy. related to cors.go...

CVE-2021-23986

A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The response to this cross-origin request could have been read by the extension, allowing a same-origin policy bypass by the extension, which should not have...

CVE-2021-23986

A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The response to this cross-origin request could have been read by the extension, allowing a same-origin policy bypass by the extension, which should not have...