CVE-2015-1267: Undefined Security Weakness

Blink, as used in Google Chrome before 43.0.2357.130, does not properly restrict the creation context during creation of a DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that uses a Blink public API, related to WebArrayBufferConverter.cpp,...

UBUNTU-CVE-2015-1267

Blink, as used in Google Chrome before 43.0.2357.130, does not properly restrict the creation context during creation of a DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that uses a Blink public API, related to WebArrayBufferConverter.cpp,...

CVE-2015-1268: Undefined Security Weakness

bindings/scripts/v8types.py in Blink, as used in Google Chrome before 43.0.2357.130, does not properly select a creation context for a return value's DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code, as demonstrated by use of a data: URL...

PT-2015-1422

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 43.0.2357.130 Description The issue is related to errors in security settings of the Blink component in Google Chrome, allowing a remote attacker to bypass access restrictions using JavaScript that utilizes the...

PT-2015-1423

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 43.0.2357.130 Opera affected versions not specified Description The issue is related to the bindings/scripts/v8 types.py file in Blink, which does not properly select a creation context for a return value's DOM...

CVE-2015-3102: Exposure of Sensitive Information to an Unauthorized Actor

Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe...

Microsoft Exchange Server Same-Origin Policy Bypass Vulnerability

Microsoft Exchange Server is an enterprise-class mail service program. A same-origin policy bypass vulnerability exists in Microsoft Exchange Server, which could be exploited by a remote attacker to submit a special web application request to bypass the same-origin policy and obtain sensitive...

CVE-2015-3099: Exposure of Sensitive Information to an Unauthorized Actor

Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe...

CVE-2015-3098: Exposure of Sensitive Information to an Unauthorized Actor

Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe...

CVE-2015-1764: Undefined Security Weakness

The web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allow remote attackers to bypass the Same Origin Policy and send HTTP traffic to intranet servers via a crafted request, related to a Server-Side Request Forgery SSRF issue, aka "Exchange Server-Side Request Forger...

PT-2015-2774

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2013 SP1 Microsoft Exchange Server Cumulative Update 8 Description The issue is related to a Server-Side Request Forgery SSRF problem, where remote attackers can bypass the Same Origin Policy and send HTTP traffic to...

chromium: multiple issues

CVE-2015-1251 arbitrary code execution Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem allows remote attackers to execute arbitrary code via a crafted document. - CVE-2015-1252 sandbox protection bypass It has been discovered that...

CVE-2015-1254: Undefined Security Weakness

core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing...

CVE-2015-1253: Improper Access Control

core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and executeReparentTask...

PT-2015-1192

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 43.0.2357.65 Description The issue is related to errors in the HTMLConstructionSite.cpp file in the DOM implementation in Blink, used in Google Chrome. It allows remote attackers to bypass the Same Origin Policy...

PT-2015-1193

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 43.0.2357.65 Opera affected versions not specified Description The issue allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing, due to the inheritance of the designMo...

CVE-2015-2718: Exposure of Sensitive Information to an Unauthorized Actor

The WebChannel.jsm module in Mozilla Firefox before 38.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive webchannel-response data via a crafted web site containing an IFRAME element referencing a different web site that is intended to read this data...

PT-2015-5855

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 38.0 Description The issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive webchannel-response data. This can be achieved via a crafted web site containing an IFRAME element...

PT-2015-5138

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 6.2.6 Apple Safari versions 7.x prior to 7.1.6 Apple Safari versions 8.x prior to 8.0.6 Description The issue concerns the page-loading implementation in WebKit, which does not properly handle the rel attribute i...

CVE-2015-1155: Undefined Security Weakness

The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same Origin Policy and read arbitrary files via a crafted web site...