CVE-2018-18352: Incorrect Permission Assignment for Critical Resource

Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass same origin policy for audio content via a crafted HTML page...

Debian: Security Advisory (DSA-4354-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2018-2710

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 64 Firefox ESR versions prior to 60.4 Thunderbird versions prior to 60.4 Description The issue is related to a same-origin policy violation, which can be exploited by a remote attacker to redirect users to malicious...

chromium-browser: Inappropriate implementation in Media

Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass same origin policy for audio content via a crafted HTML page...

CVE-2018-18362

Norton Password Manager for Android formerly Norton Identity Safe may be susceptible to a cross site scripting XSS exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by...

Google Chrome Media Information Disclosure Vulnerability

Google Chrome is a web browser developed by Google, Inc.Media is one of the multimedia components. A security vulnerability exists in Media in versions of Google Chrome prior to 71.0.3578.80. A remote attacker can exploit this vulnerability to bypass the same-origin policy used for audio content...

PT-2018-14418

Name of the Vulnerable Software and Affected Versions Norton Password Manager for Android affected versions not specified Description The issue is related to a cross-site scripting XSS exploit, which can enable attackers to inject client-side scripts into web pages viewed by other users. This typ...

CVE-2018-18362: Improper Neutralization of Input During Web Page Generation

Norton Password Manager for Android formerly Norton Identity Safe may be susceptible to a cross site scripting XSS exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by...

CVE-2018-18352

Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass same origin policy for audio content via a crafted HTML page...

PT-2018-2647

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 71.0.3578.80 Description The issue is related to errors in access control, allowing a remote attacker to bypass the same origin policy for audio content using a specially crafted HTML page. This could enable...

DVWA Pro-test CSRF vulnerability-vulnerability warning-the black bar safety net

CSRF is a cross-site request forgery, i.e., a user at A site after login in the same client of the Site B using the vulnerability to get A site's Cookie and other authentication information, and forgery as legitimate identity request to A site. This article in the local environment, carry out the...

Same Origin Policy Bypass

Plupload is vulnerable to same origin policy bypass. Overly permissive Flash allows scripts from any domain to be run, allowing remote attackers to bypass the same origin policy via crafted swf content...

Code Injection

valine is vulnerable to code injection. The vulnerability is possible because the EMBED tags are not validated to enforce same-origin policy, allowing the attacker to inject HTML combined with a .pdf file...

RHEL 7 : thunderbird (RHSA-2018:3458)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:3458 advisory. - Mozilla: Proxy bypass using automount and autofs CVE-2017-16541 - Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2...

RHEL 6 : thunderbird (RHSA-2018:3403)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:3403 advisory. - Mozilla: Proxy bypass using automount and autofs CVE-2017-16541 - Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2...

Mozilla: Same-origin policy violation using meta refresh and performance.getEntries to steal cross-origin URLs

A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a redirection to another site using performance.getEntries. This is a same-origin policy violation and could allow for data theft. This vulnerability affects...

nodejs: Inspector DNS rebinding vulnerability

It was found that when a Node.js script is run in inspector mode, Node.js did not properly validate the Host header, leaving the inspector vulnerable to a DNS rebind attack and bypass same-origin policy. If a developer had an inspector session running, and was visiting a malicious website, the si...

Microsoft Edge Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins. The vulnerability allows Microsoft Edge to bypass Same-Origin Policy SOP restrictions, and to allow requests that should otherwise be ignored. An attacker who successfully exploite...

Microsoft Edge Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins. The vulnerability allows Microsoft Edge to bypass Same-Origin Policy SOP restrictions, and to allow requests that should otherwise be ignored. An attacker who successfully exploite...

PT-2018-2123

Name of the Vulnerable Software and Affected Versions Microsoft Edge affected versions not specified Description The issue is related to errors in request handling mechanisms, allowing a remote attacker to disclose protected information using a specially crafted web page. It is a security feature...