CVE-2018-5136

A shared worker created from a "data:" URL in one tab can be shared by another tab with a different origin, bypassing the same-origin policy. This vulnerability affects Firefox 59...

CVE-2017-7797

Response header name interning does not have same-origin protections and these headers are stored in a global registry. This allows stored header names to be available cross-origin. This vulnerability affects Firefox 55...

CVE-2017-7759

Android intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs to local "file:" URLs, allowing for the reading of local data through a violation of same-origin policy. Note: This attack only affects Firefox for Android. Other operating systems are not affected...

CVE-2017-7759

Firefox for Android prior to version 54 is affected by CVE-2017-7759, where Android intent URLs can cause navigation from HTTP/HTTPS to local file: URLs, potentially exposing local data due to a same-origin policy violation. The issue is fixed in Firefox 54 (as noted in mfsa2017-15). Affected pro...

CVE-2017-7787

Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to information disclosure. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox 55...

CVE-2017-5407

CVE-2017-5407 describes a information-disclosure flaw in SVG filters due to floating-point timing side channels that can leak pixel data and history across origins. Affected products include Mozilla Firefox and Thunderbird versions older than 52 (Firefox ESR older than 45.8; Thunderbird older tha...

CVE-2018-5157

CVE-2018-5157 affects Mozilla Firefox prior to 60.0 (including ESR

CVE-2017-7787

Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to information disclosure. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox 55...

CVE-2017-5407

Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extract history information and read text values across domains. This violates same-origin policy and leads to information...

chromium-browser: Incorrect escaping of MathML in Blink

Insufficient data validation in HTML parser in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass same origin policy via a crafted HTML page...

DEBIAN-CVE-2018-12015

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name...

ALPINE-CVE-2018-12015

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name...

Unauthorized Access Vulnerability in Multiple Philips Products

Philips IntelliVue Patient Monitors MP2 and others are products of the Dutch company Philips.Philips IntelliVue Patient Monitors MP2 is a patient monitor device of the MP series.Avalon Fetal/Maternal The Avalon Fetal/Maternal Monitors FM20 is a maternal/infant monitor. An unauthorized access...

Philips IntelliVue Patient and Avalon Fetal Monitors Information Exposure Vulnerability

Philips IntelliVue Patient Monitors MP2 and others are products of the Dutch company Philips.Philips IntelliVue Patient Monitors MP2 is a patient monitor device of the MP series.Avalon Fetal/Maternal The Avalon Fetal/Maternal Monitors FM20 is a maternal/infant monitor. An information exposure...

Reading Your Emails With A Read&Write Chrome Extension Same Origin Policy Bypass (~8 Million Users Affected)

Summary Due to a lack of proper origin checks in the message passing from regular web pages, any arbitrary web page is able to call privileged background page APIs for the Read&Write Chrome extension vulnerable version 1.8.0.139. Many of these APIs allow for dangerous actions which are not meant ...

Reading Your Emails With A Read&Write Chrome Extension Same Origin Policy Bypass (~8 Million Users Affected)

Summary Due to a lack of proper origin checks in the message passing from regular web pages, any arbitrary web page is able to call privileged background page APIs for the Read&Write Chrome extension vulnerable version 1.8.0.139. Many of these APIs allow for dangerous actions which are not meant ...

Mail.ru: DNS Misconfiguration

Your localhost.mail.ru has address 127.0.0.1 and this may lead to "Same- Site" Scripting. Here is detailed description of this minor security issue by Tavis Ormandy: http://www.securityfocus.com/archive/1/486606/30/0/threaded I can also ping the localhost network from mail.ru, as in the image...

EOS.IO DAWN Denial of Service Vulnerability

EOS.IO DAWN is a smart contract platform based on blockchain technology. The platform is used to deploy decentralized applications. A security vulnerability exists in EOS.IO DAWN version 4.2, which stems from the plugins/netplugin/netplugin.cpp file failing to limit the number of P2P links from t...

CVE-2016-10549

Sails is an MVC style framework for building realtime web applications. Version 0.12.7 and lower have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This would allow an attacker to make AJAX requests ...

Cross site scripting

Sails is an MVC style framework for building realtime web applications. Version 0.12.7 and lower have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This would allow an attacker to make AJAX requests ...