PT-2018-16896

Name of the Vulnerable Software and Affected Versions Cheetah Mobile Armorfly Browser & Downloader version 1.1.05.0010 Description The issue allows for Same Origin Policy Bypass when the Cheetah Mobile Armorfly Browser & Downloader is installed on older Android platforms. Recommendations For...

CVE-2018-5326: Undefined Security Weakness

Cheetah Mobile CM Browser 5.22.06.0012, when installed on unspecified "older" Android platforms, allows Same Origin Policy Bypass...

CVE-2018-5327: Undefined Security Weakness

Cheetah Mobile Armorfly Browser & Downloader 1.1.05.0010, when installed on unspecified "older" Android platforms, allows Same Origin Policy Bypass...

CVE-2017-18016

Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine reusing the current website's token, which is not bound to an origin...

PT-2018-6612

Name of the Vulnerable Software and Affected Versions: Parity Browser versions 1.6.10 and earlier Description: The issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine. This is possible because...

CVE-2017-18016: Origin Validation Error

Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine reusing the current website's token, which is not bound to an origin...

Parity Browser 1.6.10 - Bypass Same Origin Policy

Parity Browser 1.6.10 - Bypass Same Origin Policy VuNote ====== Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016 Version: 0.3 Date: Jun 16th, 2017 Tag: parity same origin policy bypass webproxy token reuse Overview -------- Name: parity Vendor: paritytech References:...

CVE-2017-17859: Improper Neutralization of Input During Web Page Generation

Samsung Internet Browser 6.2.01.12 allows remote attackers to bypass the Same Origin Policy, and conduct UXSS attacks to obtain sensitive information, via vectors involving an IFRAME element inside XSLT data in one part of an MHTML file. Specifically, JavaScript code in another part of this MHTML...

PT-2017-15052

Name of the Vulnerable Software and Affected Versions Samsung Internet Browser version 6.2.01.12 Description The issue allows remote attackers to bypass the Same Origin Policy and conduct UXSS attacks to obtain sensitive information. This is achieved via vectors involving an IFRAME element inside...

PT-2017-14952

Name of the Vulnerable Software and Affected Versions Samsung Internet Browser version 5.4.02.3 Description The issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code. This is achieved by redirecting to a child tab and rewriting...

CVE-2017-17692: Exposure of Sensitive Information to an Unauthorized Actor

Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that redirects to a child tab and rewrites the innerHTML property...

CVE-2017-16369: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This vulnerability is an instance of a Same Origin Policy security bypass vulnerability, affecting...

[ASA-201711-43] thunderbird: multiple issues

Arch Linux Security Advisory ASA-201711-43 ========================================== Severity: Critical Date : 2017-11-30 CVE-ID : CVE-2017-7826 CVE-2017-7828 CVE-2017-7830 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-530 Summary ======= The...

PT-2017-4039

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 59 Description The issue is related to a shared worker created from a "data:" URL in one tab being shared by another tab with a different origin, which bypasses the same-origin policy. This allows a remote attacker to...

[ASA-201711-23] firefox: multiple issues

Arch Linux Security Advisory ASA-201711-23 ========================================== Severity: Critical Date : 2017-11-15 CVE-ID : CVE-2017-7826 CVE-2017-7827 CVE-2017-7828 CVE-2017-7830 CVE-2017-7831 CVE-2017-7832 CVE-2017-7833 CVE-2017-7834 CVE-2017-7835 CVE-2017-7836 CVE-2017-7837 CVE-2017-78...

PT-2017-14382

Name of the Vulnerable Software and Affected Versions Adobe Acrobat and Reader versions 2017.012.20098 and earlier Adobe Acrobat and Reader versions 2017.011.30066 and earlier Adobe Acrobat and Reader versions 2015.006.30355 and earlier Adobe Acrobat and Reader versions 11.0.22 and earlier...

PT-2017-13130

Name of the Vulnerable Software and Affected Versions macOS versions prior to 10.13.1 Description The issue involves the HelpViewer component and allows remote attackers to inject arbitrary web script or HTML by bypassing the Same Origin Policy for quarantined HTML documents, which is a cross-sit...

CVE-2017-7090: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to...

PT-2017-17503

Name of the Vulnerable Software and Affected Versions iOS versions prior to 11 Safari versions prior to 11 iCloud versions prior to 7.0 on Windows iTunes versions prior to 12.7 on Windows tvOS versions prior to 11 Description The issue involves the WebKit component and allows remote attackers to...

CVE-2017-7090

An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to...