PT-2016-6293

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 53.0.2785.113 Opera affected versions not specified Description The issue is related to the extensions subsystem not properly restricting access to Object.prototype, allowing remote attackers to load unintended...

Chrome < 52.0.2743.82 Multiple Vulnerabilities

Binary data 802027.prm...

webkit2gtk: multiple issues

CVE-2016-4590 same-origin policy bypass xisigr of Tencents Xuanwu Lab discovered a vulnerability in the way webkit handles URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. - CVE-2016-4591 arbitrary filesystem access ma.la of LINE Corporation discoveered...

CVE-2016-5145: Undefined Security Weakness

Blink, as used in Google Chrome before 52.0.2743.116, does not ensure that a taint property is preserved after a structure-clone operation on an ImageBitmap object derived from a cross-origin image, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code...

CVE-2016-5265

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS UXSS attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same loca...

CVE-2016-5265: Improper Neutralization of Input During Web Page Generation

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS UXSS attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same loca...

PT-2016-6265

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 52.0.2743.116 Opera affected versions not specified Description The issue arises from the handling of a taint property after a structure-clone operation on an ImageBitmap object derived from a cross-origin image...

PT-2016-2521

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 48.0 Firefox ESR versions prior to 45.3 Description The issue allows remote attackers to bypass the Same Origin Policy, conduct Universal XSS UXSS attacks, or read arbitrary files by arranging for the presence...

Multiple Apple products WebKit homology policy bypass vulnerability (CNVD-2016-05666)

Apple iOS, Safari, and tvOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices; Safari is a web browser that is the default browser that comes with Mac OS X and iOS operating systems; and tvOS is an operating system for smart TVs. webKit is an open source web...

CVE-2016-1711: Improper Authorization

WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not disable frame navigation during a detach operation on a DocumentLoader object, which allows remote attackers to bypass the Same Origin Policy via a crafted web site...

CVE-2016-1710: Improper Authorization

The ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not prevent window creation by a deferred frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site...

CVE-2016-5132: Undefined Security Weakness

The Service Workers subsystem in Google Chrome before 52.0.2743.82 does not properly implement the Secure Contexts specification during decisions about whether to control a subframe, which allows remote attackers to bypass the Same Origin Policy via an https IFRAME element inside an http IFRAME...

CVE-2016-5128: Undefined Security Weakness

objects.cc in Google V8 before 5.2.361.27, as used in Google Chrome before 52.0.2743.82, does not prevent API interceptors from modifying a store target without setting a property, which allows remote attackers to bypass the Same Origin Policy via a crafted web site...

CVE-2016-4590

WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site...

CVE-2016-4590: Improper Input Validation

WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site...

CVE-2016-4583: Concurrent Execution using Shared Resource with Improper Synchronization

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document...

PT-2016-6047

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 9.3.3 Safari versions prior to 9.1.2 Description The issue is related to how WebKit in Apple iOS and Safari handles about: URLs, allowing remote attackers to bypass the Same Origin Policy via a crafted web site...

PT-2016-2654

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 52.0.2743.82 Opera affected versions not specified Description The issue is related to the WebKit/Source/core/loader/FrameLoader.cpp file in the Blink component, which does not properly disable frame navigation...

PT-2016-6252

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 52.0.2743.82 Google V8 versions prior to 5.2.361.27 Opera affected versions not specified Description The issue allows remote attackers to bypass the Same Origin Policy via a crafted web site, due to the failure...

PT-2016-2655

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 52.0.2743.82 Opera affected versions not specified Description The issue concerns the ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink. This method does not prevent window...