PT-2016-1262

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 48.0.2564.109 Opera affected versions not specified Description The issue is related to the Extensions subsystem, which does not properly restrict access to certain functions. This allows remote attackers to...

PT-2016-1181

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 9 through 11 Description The issue is related to insufficient access restrictions in Internet Explorer, allowing remote attackers to bypass the Same Origin Policy. This could enable an attacker to access...

PT-2016-1261

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 48.0.2564.109 Opera affected versions not specified Description The issue is related to the DOM implementation in the browser, which does not properly restrict frame-attach operations from occurring during or...

CVE-2016-0005: Improper Input Validation

Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of Privilege Vulnerability."...

PT-2016-1019

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 9 through 11 Description The issue is related to the improper enforcement of cross-domain policies in Internet Explorer, which could allow a remote attacker to bypass the Same Origin Policy. This could enab...

MGASA-2015-0492 Updated thunderbird packages fix security vulnerabilities

Updated thunderbird packages fix security vulnerabilities: Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird...

CVE-2015-7215: Exposure of Sensitive Information to an Unauthorized Actor

The importScripts function in the Web Workers API implementation in Mozilla Firefox before 43.0 allows remote attackers to bypass the Same Origin Policy by triggering use of the no-cors mode in the fetch API to attempt resource access that throws an exception, leading to information disclosure...

CVE-2015-7214: Exposure of Sensitive Information to an Unauthorized Actor

Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-source: URIs...

CVE-2015-7207: Exposure of Sensitive Information to an Unauthorized Actor

Mozilla Firefox before 43.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls, a...

firefox: multiple issues

CVE-2015-7201 CVE-2015-7202 arbitrary code execution Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we...

CVE-2015-6164: Improper Input Validation

Microsoft Internet Explorer 9 through 11 improperly implements a cross-site scripting XSS protection mechanism, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, aka "Internet Explorer XSS Filter Bypass Vulnerability."...

PT-2015-3016

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 9 through 11 Description The issue arises from improper implementation of a cross-site scripting XSS protection mechanism in Microsoft Internet Explorer, allowing remote attackers to bypass the Same Origin...

CVE-2015-6772

The DOM implementation in Blink, as used in Google Chrome before 47.0.2526.73, does not prevent javascript: URL navigation while a document is being detached, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that improperly interacts with a plugin...

CVE-2015-6769

The provisional-load commit implementation in WebKit/Source/bindings/core/v8/WindowProxy.cpp in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy by leveraging a delay in window proxy clearing...

CVE-2015-6770

The DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-6768...

CVE-2015-6768

The DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-6770...

CVE-2015-6768: Undefined Security Weakness

The DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-6770...

CVE-2015-6772: Undefined Security Weakness

The DOM implementation in Blink, as used in Google Chrome before 47.0.2526.73, does not prevent javascript: URL navigation while a document is being detached, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that improperly interacts with a plugin...

CVE-2015-6770: Undefined Security Weakness

The DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-6768...

CVE-2015-6769: Undefined Security Weakness

The provisional-load commit implementation in WebKit/Source/bindings/core/v8/WindowProxy.cpp in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy by leveraging a delay in window proxy clearing...