1062 matches found
CVE-2021-23986: Origin Validation Error
A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The response to this cross-origin request could have been read by the extension, allowing a same-origin policy bypass by the extension, which should not have...
PT-2021-15641
Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 87 Description: A malicious extension with the search permission could bypass the same-origin policy by installing a new search engine whose favicon references a cross-origin URL. The response to this cross-origin...
Microsoft Edge (Chromium) < 87.0.664.41 Multiple Vulnerabilities
The version of Microsoft Edge installed on the remote Windows host is prior to 87.0.664.41. It is, therefore, affected by multiple vulnerabilities as referenced in the ADV200002-11-19-2020 advisory. - Adobe Flash Player version 32.0.0.192 and earlier versions have a Same Origin Policy Bypass...
CVE-2020-15992
Insufficient policy enforcement in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page...
CVE-2020-15973
Insufficient policy enforcement in extensions in Google Chrome prior to 86.0.4240.75 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension...
CVE-2020-15973: Undefined Security Weakness
Insufficient policy enforcement in extensions in Google Chrome prior to 86.0.4240.75 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension...
CVE-2020-15992: Undefined Security Weakness
Insufficient policy enforcement in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page...
CVE-2020-9911: Undefined Security Weakness
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.6 and iPadOS 13.6, Safari 13.1.2. An issue in Safari Reader mode may allow a remote attacker to bypass the Same Origin Policy...
PT-2020-5711
Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 86.0.4240.75 Description: The issue is related to insufficient policy enforcement in extensions, allowing a remote attacker to impact data integrity by convincing a user to install a malicious extension. This c...
PT-2020-5038
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 86.0.4240.75 Description The issue is related to insufficient policy enforcement in the networking component of Google Chrome, which can be exploited by a remote attacker who has compromised the renderer process...
Same-Origin Policy Bypass
firefox is vulnerable to same-origin policy bypass. An attacker could create a malicious web page that, when viewed by a victim, could steal private data from a different website the victim had loaded with Firefox...
Same-Origin Policy Bypass
thunderbird is vulnerable to same-origin policy bypass. Several flaws were found in the way malformed content was processed. An HTML mail message containing specially-crafted content could potentially trick a Thunderbird user into surrendering sensitive information...
Same-Origin Policy Bypass
seamonkey is vulnerable to same-origin policy bypass. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey...
CVE-2016-5265
Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS UXSS attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same loca...
CVE-2020-6420
Insufficient policy enforcement in media in Google Chrome prior to 80.0.3987.132 allowed a remote attacker to bypass same origin policy via a crafted HTML page...
CVE-2020-6420: Undefined Security Weakness
Insufficient policy enforcement in media in Google Chrome prior to 80.0.3987.132 allowed a remote attacker to bypass same origin policy via a crafted HTML page...
PT-2020-2765
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 80.0.3987.132 Description The issue is due to insufficient policy enforcement in the media subsystem of Google Chrome, allowing a remote attacker to bypass the same origin policy. This can be achieved via a...
[ASA-202002-10] webkit2gtk: multiple issues
Arch Linux Security Advisory ASA-202002-10 ========================================== Severity: High Date : 2020-02-17 CVE-ID : CVE-2020-3862 CVE-2020-3864 CVE-2020-3865 CVE-2020-3867 CVE-2020-3868 Package : webkit2gtk Type : multiple issues Remote : Yes Link :...
CVE-2019-18378: Improper Neutralization of Input During Web Page Generation
Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a cross-site scripting XSS exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to potentiall...