CVE-2014-3620

cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain...

CVE-2014-3620: Undefined Security Weakness

cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain...

Firefox < 33.0 Multiple Vulnerabilities (Mac OS X)

The version of Firefox installed on the remote Mac OS X host is a version prior to 33.0. It is, therefore, affected by the following vulnerabilities : - Multiple memory safety flaws exist within the browser engine. Exploiting these, an attacker can cause a denial of service or execute arbitrary...

CVE-2014-1583: Undefined Security Weakness

The Alarm API in Mozilla Firefox before 33.0 and Firefox ESR 31.x before 31.2 does not properly restrict toJSON calls, which allows remote attackers to bypass the Same Origin Policy via crafted API calls that access sensitive information within the JSON data of an alarm...

Second Same-Origin Policy Bypass Flaw Haunts Android Browser

There is another same-origin policy bypass vulnerability in the Android browser in versions prior to 4.4 that allows an attacker to steal data from a user’s browser. Google has fixed the vulnerability in some versions of Android, but millions of users of older versions are still affected. The...

PT-2014-4235

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 33.0 Mozilla Firefox ESR versions prior to 31.2 Description The issue is related to the Alarm API in Mozilla Firefox, which does not properly restrict toJSON calls. This allows remote attackers to bypass the...

PT-2014-6402

Name of the Vulnerable Software and Affected Versions jigbrowser+ versions 1.8.1 and earlier Description The issue allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code. Recommendations For jigbrowser+ versions 1.8.1 and earlier, at the moment, there is no informati...

CVE-2014-5318: Undefined Security Weakness

The jigbrowser+ application 1.8.1 and earlier for iOS allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code...

CVE-2014-0548

Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow...

PT-2014-5424

Name of the Vulnerable Software and Affected Versions cURL and libcurl versions prior to 7.38.0 Description The issue allows remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain. This occurs because libcurl wrongly allows...

CVE-2014-0548: Undefined Security Weakness

Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow...

PT-2014-1365

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 13.0.0.244 Adobe Flash Player versions 14.x and 15.x prior to 15.0.0.152 on Windows and OS X Adobe Flash Player versions prior to 11.2.202.406 on Linux Adobe AIR versions prior to 15.0.0.249 on Windows and ...

Adobe Flash Player Same Origin Policy Bypass (APSB14-14; CVE-2014-0516)

A security bypass vulnerability has been reported in Adobe Flash Player. The vulnerability is due to an error in Adobe Flash Player while parsing a specially crafted SWF file. A remote attacker can exploit this issue by enticing a victim to open a specially crafted SWF file...

CVE-2014-6041

The Android WebView in Android before 4.4 allows remote attackers to bypass the Same Origin Policy via a crafted attribute containing a \u0000 character, as demonstrated by an onclick="window.open'\u0000javascript: sequence to the Android Browser application 4.2.1 or a third-party web browser...

PT-2014-7019

Name of the Vulnerable Software and Affected Versions Android versions prior to 4.4 Description The issue allows remote attackers to bypass the Same Origin Policy. This can be achieved via a crafted attribute containing a u0000 character. For example, an onclick attribute with a window.open...

CVE-2014-6041: Undefined Security Weakness

The Android WebView in Android before 4.4 allows remote attackers to bypass the Same Origin Policy via a crafted attribute containing a \u0000 character, as demonstrated by an onclick="window.open'\u0000javascript: sequence to the Android Browser application 4.2.1 or a third-party web browser...

PT-2014-4567

Name of the Vulnerable Software and Affected Versions UniFi Video versions prior to 3.0.1 Description The issue concerns the default Flash cross-domain policy in UniFi Video, which does not properly restrict access to the application. This allows remote attackers to bypass the Same Origin Policy ...

CVE-2014-2227: Undefined Security Weakness

The default Flash cross-domain policy crossdomain.xml in Ubiquiti Networks UniFi Video formerly AirVision aka AirVision Controller before 3.0.1 does not restrict access to the application, which allows remote attackers to bypass the Same Origin Policy via a crafted SWF file...

CVE-2014-3160: Undefined Security Weakness

The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a crafted file...

CVE-2014-3161: Undefined Security Weakness

The WebMediaPlayerAndroid::load function in content/renderer/media/android/webmediaplayerandroid.cc in Google Chrome before 36.0.1985.122 on Android does not properly interact with redirects, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that hosts a video...