CVE-2016-1955: Exposure of Sensitive Information to an Unauthorized Actor

Mozilla Firefox before 45.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy CSP violation report that contains path information associated with an IFRAME element...

PT-2016-1462

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 45.0 Description The issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy CSP violation report that contains path information...

PT-2016-1450

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 45.0 Description The issue is related to an incomplete restriction of IFRAME Resource Timing API times, allowing remote attackers to bypass the Same Origin Policy and obtain sensitive information. This can be...

CVE-2016-1630

The ContainerNode::parserRemoveChild function in WebKit/Source/core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 49.0.2623.75, mishandles widget updates, which makes it easier for remote attackers to bypass the Same Origin Policy via a crafted web site...

CVE-2016-1631

The PPBFlashMessageLoopImpl::InternalRun function in content/renderer/pepper/ppbflashmessageloopimpl.cc in the Pepper plugin in Google Chrome before 49.0.2623.75 mishandles nested message loops, which allows remote attackers to bypass the Same Origin Policy via a crafted web site...

CVE-2016-1630: Undefined Security Weakness

The ContainerNode::parserRemoveChild function in WebKit/Source/core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 49.0.2623.75, mishandles widget updates, which makes it easier for remote attackers to bypass the Same Origin Policy via a crafted web site...

CVE-2016-1631: Undefined Security Weakness

The PPBFlashMessageLoopImpl::InternalRun function in content/renderer/pepper/ppbflashmessageloopimpl.cc in the Pepper plugin in Google Chrome before 49.0.2623.75 mishandles nested message loops, which allows remote attackers to bypass the Same Origin Policy via a crafted web site...

PT-2016-1342

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 49.0.2623.75 Opera affected versions not specified Description The issue is related to the ContainerNode::parserRemoveChild function in WebKit/Source/core/dom/ContainerNode.cpp in Blink, which mishandles widget...

Google Chrome < 48.0.2564.116 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 48.0.2564.116. It is, therefore, affected by a vulnerability as referenced in the 201602stable-channel-update18 advisory. - Google Chrome before 48.0.2564.116 allows remote attackers to bypass the Blink Same Origin Poli...

Comodo Chromodo Homologation Policy Security Bypass Vulnerability

Comodo Chromodo is a Chromium-based browser product. Comodo Chromodo suffers from a same-origin policy security bypass vulnerability that could be exploited by an attacker to bypass access restrictions, obtain sensitive data, or execute arbitrary code in the browser context to steal sensitive...

Ebay Cross Site Scripting

Hello all, Description: Persistent DOM based Cross Site Scripting on ebay.com domain. Disclosed to Ebay: January 2015 Fixed: February 2016 Vulnerability location: Every listing Who are able to create: Sellers Same origin policy bypass via postMessage Write-up:...

PT-2016-1287

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 48.0.2564.116 Description The issue is related to the Blink engine in Google Chrome, which has an access control flaw. This flaw can be exploited by a remote attacker to bypass the Same Origin Policy and a sandb...

CVE-2016-0068: Undefined Security Weakness

Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0069...

CVE-2016-0069: Undefined Security Weakness

Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0068...

CVE-2016-1623

The DOM implementation in Google Chrome before 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to FrameLoader.cpp,...

CVE-2016-1622

The Extensions subsystem in Google Chrome before 48.0.2564.109 does not prevent use of the Object.defineProperty method to override intended extension behavior, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code...

CVE-2016-1622: Undefined Security Weakness

The Extensions subsystem in Google Chrome before 48.0.2564.109 does not prevent use of the Object.defineProperty method to override intended extension behavior, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code...

CVE-2016-1623: Undefined Security Weakness

The DOM implementation in Google Chrome before 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to FrameLoader.cpp,...

CVE-2016-1949: Undefined Security Weakness

Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and plugins, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that triggers spoofed responses to requests that use NPAPI, as demonstrated by a request for a...

PT-2016-1256

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 44.0.2 Description The issue is related to insufficient access control between the Service Workers interface and plugins in the browser. This can be exploited by a remote attacker using a specially crafted...