CVE-2015-5788: Exposure of Sensitive Information to an Unauthorized Actor

The WebKit Canvas implementation in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain sensitive image information via vectors involving a CANVAS element...

CVE-2015-5826: Improper Access Control

WebKit in Apple iOS before 9 does not properly select the cases in which a Cascading Style Sheets CSS document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site...

CVE-2015-5827: Exposure of Sensitive Information to an Unauthorized Actor

WebKit in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain an object reference via vectors involving a 1 custom event, 2 message event, or 3 pop state event...

Adobe AIR < 18.0.0.180 Multiple Vulnerabilities (APSB15-16)

Binary data 8858.prm...

MGASA-2015-0342 Updated iceape packages fix security vulnerabilities

Updated iceape packages fix security issues: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to cause a denial of service memory corruption and application crash or possibly...

CVE-2015-1293

The DOM implementation in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy via unspecified vectors...

CVE-2015-1291

The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not check whether a node is expected, which allows remote attackers to bypass the Same Origin Policy or cause a denial of service DOM tree corruption via a web...

CVE-2015-1291: Undefined Security Weakness

The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not check whether a node is expected, which allows remote attackers to bypass the Same Origin Policy or cause a denial of service DOM tree corruption via a web...

CVE-2015-1292: Undefined Security Weakness

The NavigatorServiceWorker::serviceWorker function in modules/serviceworkers/NavigatorServiceWorker.cpp in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy by accessing a Service Worker...

CVE-2015-1293: Undefined Security Weakness

The DOM implementation in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy via unspecified vectors...

PT-2015-1931

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 45.0.2454.85 Opera affected versions not specified Description The issue is related to the DOM implementation in Blink, which allows remote attackers to bypass the Same Origin Policy. This is due to insufficient...

PT-2015-1929

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 45.0.2454.85 Opera affected versions not specified Description The issue is related to the ContainerNode::parserRemoveChild function in Blink, which does not properly check whether a node is expected. This allow...

PT-2015-1930

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 45.0.2454.85 Opera affected versions not specified Description The issue is related to the NavigatorServiceWorker::serviceWorker function in the Blink component of Google Chrome, which has insufficient access...

PT-2015-1873

Name of the Vulnerable Software and Affected Versions Safari versions prior to 6.2.8 Safari versions 7.x prior to 7.1.8 Safari versions 8.x prior to 8.0.8 iOS versions prior to 8.4.1 Description The issue is related to the WebKit component in Safari and iOS, which does not properly perform taint...

CVE-2015-3753: Exposure of Sensitive Information to an Unauthorized Actor

WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive image data by leveraging a...

CVE-2015-4478: Exposure of Sensitive Information to an Unauthorized Actor

Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 do not impose certain ECMAScript 6 requirements on JavaScript object properties, which allows remote attackers to bypass the Same Origin Policy via the reviver parameter to the JSON.parse method...

Firefox < 40 Multiple Vulnerabilities

The version of Firefox installed on the remote Windows host is prior to 40. It is, therefore, affected by the following vulnerabilities : - Multiple memory corruption issues exist that allow a remote attacker, via a specially crafted web page, to corrupt memory and potentially execute arbitrary...

Mozilla Firefox ESR < 38.2

The version of Firefox ESR installed on the remote Windows host is prior to 38.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2015-83 advisory. - crash in @ stagefright::SampleTable::isValid with h264 mp4CVE-2015-4480 CVE-2015-4480 - MPEG4 saio Chunk Integer...

Firefox < 40 Multiple Vulnerabilities (Mac OS X)

The version of Firefox installed on the remote Mac OS X host is prior to 40. It is, therefore, affected by the following vulnerabilities : - Multiple memory corruption issues exist that allow a remote attacker, via a specially crafted web page, to corrupt memory and potentially execute arbitrary...

PT-2015-1895

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 40.0 Firefox ESR versions prior to 38.2 Description The issue is related to the lack of protection for certain data in Firefox browsers, allowing remote attackers to bypass the Same Origin Policy. This can be...