CVE-2014-3161: Undefined Security Weakness

The WebMediaPlayerAndroid::load function in content/renderer/media/android/webmediaplayerandroid.cc in Google Chrome before 36.0.1985.122 on Android does not properly interact with redirects, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that hosts a video...

PT-2014-1381

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 36.0.1985.125 Description The issue is related to the ResourceFetcher::canRequest function in Blink, which does not properly restrict subresource requests associated with SVG files. This allows remote attackers ...

Microsoft Internet Explorer 5 Dialog Same Origin Policy Bypass Variant Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5561/info Microsoft Internet Explorer includes support for dialog windows through script calls to the two functions showModalDialog and showModelessDialog. These functions accept a URL location for the dialog content, and...

CVE-2014-0516

Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow remote attackers to bypass the Same Origin Policy via unspecified vectors...

CVE-2014-0516: Undefined Security Weakness

Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow remote attackers to bypass the Same Origin Policy via unspecified vectors...

PT-2014-1351

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 13.0.0.214 on Windows and OS X Adobe Flash Player versions prior to 11.2.202.359 on Linux Adobe AIR SDK versions prior to 13.0.0.111 Adobe AIR SDK & Compiler versions prior to 13.0.0.111 Description The iss...

CVE-2014-1726

The drag implementation in Google Chrome before 34.0.1847.116 allows user-assisted remote attackers to bypass the Same Origin Policy and forge local pathnames by leveraging renderer access...

CVE-2014-1726: Undefined Security Weakness

The drag implementation in Google Chrome before 34.0.1847.116 allows user-assisted remote attackers to bypass the Same Origin Policy and forge local pathnames by leveraging renderer access...

CVE-2014-1505

The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read text from a differen...

CVE-2014-1502: Origin Validation Error

The 1 WebGL.compressedTexImage2D and 2 WebGL.compressedTexSubImage2D functions in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to bypass the Same Origin Policy and render content in a different domain via unspecified vectors...

CVE-2014-1501: Undefined Security Weakness

Mozilla Firefox before 28.0 on Android allows remote attackers to bypass the Same Origin Policy and access arbitrary file: URLs via vectors involving the "Open Link in New Tab" menu selection...

PT-2014-4211

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 28.0 on Android Description The issue allows remote attackers to bypass the Same Origin Policy and access arbitrary file: URLs via vectors involving the "Open Link in New Tab" menu selection. Recommendations F...

PT-2014-1169

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 28.0 Firefox ESR 24.x versions prior to 24.4 Thunderbird versions prior to 24.4 SeaMonkey versions prior to 2.25 Description The issue is related to errors in the implementation of the...

PT-2014-1157

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 28.0 SeaMonkey versions prior to 2.25 Description The issue is related to errors in the implementation of the WebGL.compressedTexImage2D and WebGL.compressedTexSubImage2D functions. This allows remote attacker...

CVE-2014-0503: Undefined Security Weakness

Adobe Flash Player before 11.7.700.272 and 11.8.x through 12.0.x before 12.0.0.77 on Windows and OS X, and before 11.2.202.346 on Linux, allows remote attackers to bypass the Same Origin Policy via unspecified vectors...

CVE-2013-6657: Undefined Security Weakness

core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0.1750.117, inserts the about:blank URL during certain blocking of FORM elements within HTTP requests, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information vi...

PT-2014-3156

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 33.0.1750.117 Description The issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors. This is due to the XSS auditor in Blink inserting the...

CVE-2014-0266: Exposure of Sensitive Information to an Unauthorized Actor

The XMLHTTP ActiveX controls in XML Core Services 3.0 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to...

PT-2014-1686

Name of the Vulnerable Software and Affected Versions Microsoft XML Core Services versions 3.0 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows R...

CVE-2014-1483: Improper Restriction of Rendered UI Layers or Frames

Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information by using an IFRAME element in conjunction with certain timing measurements involving the document.caretPositionFromPoint and document.elementFromPoint...