CVE-2017-7830: Undefined Security Weakness

The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox 57, Firefox ESR 52.5, and Thunderbird 52.5...

CVE-2017-5407: Exposure of Sensitive Information to an Unauthorized Actor

Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extract history information and read text values across domains. This violates same-origin policy and leads to information...

CVE-2018-5157: Exposure of Sensitive Information to an Unauthorized Actor

Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer. This could allow the site to retrieve PDF files restricted to viewing by an authenticated user on a third-party website. This vulnerability affects Firefox ESR 52.8 an...

CVE-2016-5291: Improper Input Validation

A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird 45.5, Firefox ESR 45.5, and Firefox 50...

CVE-2016-9078: URL Redirection to Untrusted Site

Redirection from an HTTP connection to a "data:" URL assigns the referring site's origin to the "data:" URL in some circumstances. This can result in same-origin violations against a domain if it loads resources from malicious sites. Cross-origin setting of cookies has been demonstrated without t...

CVE-2017-7787: Exposure of Sensitive Information to an Unauthorized Actor

Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to information disclosure. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox 55...

CVE-2017-7759: Exposure of Sensitive Information to an Unauthorized Actor

Android intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs to local "file:" URLs, allowing for the reading of local data through a violation of same-origin policy. Note: This attack only affects Firefox for Android. Other operating systems are not affected...

CVE-2018-5136: Improper Input Validation

A shared worker created from a "data:" URL in one tab can be shared by another tab with a different origin, bypassing the same-origin policy. This vulnerability affects Firefox 59...

chromium-browser: Incorrect escaping of MathML in Blink

Insufficient data validation in HTML parser in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass same origin policy via a crafted HTML page...

ALPINE-CVE-2018-12015

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name...

DEBIAN-CVE-2018-12015

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name...

Unauthorized Access Vulnerability in Multiple Philips Products

Philips IntelliVue Patient Monitors MP2 and others are products of the Dutch company Philips.Philips IntelliVue Patient Monitors MP2 is a patient monitor device of the MP series.Avalon Fetal/Maternal The Avalon Fetal/Maternal Monitors FM20 is a maternal/infant monitor. An unauthorized access...

Philips IntelliVue Patient and Avalon Fetal Monitors Information Exposure Vulnerability

Philips IntelliVue Patient Monitors MP2 and others are products of the Dutch company Philips.Philips IntelliVue Patient Monitors MP2 is a patient monitor device of the MP series.Avalon Fetal/Maternal The Avalon Fetal/Maternal Monitors FM20 is a maternal/infant monitor. An information exposure...

Reading Your Emails With A Read&Write Chrome Extension Same Origin Policy Bypass (~8 Million Users Affected)

Summary Due to a lack of proper origin checks in the message passing from regular web pages, any arbitrary web page is able to call privileged background page APIs for the Read&Write Chrome extension vulnerable version 1.8.0.139. Many of these APIs allow for dangerous actions which are not meant ...

Reading Your Emails With A Read&Write Chrome Extension Same Origin Policy Bypass (~8 Million Users Affected)

Summary Due to a lack of proper origin checks in the message passing from regular web pages, any arbitrary web page is able to call privileged background page APIs for the Read&Write Chrome extension vulnerable version 1.8.0.139. Many of these APIs allow for dangerous actions which are not meant ...

Mail.ru: DNS Misconfiguration

Your localhost.mail.ru has address 127.0.0.1 and this may lead to "Same- Site" Scripting. Here is detailed description of this minor security issue by Tavis Ormandy: http://www.securityfocus.com/archive/1/486606/30/0/threaded I can also ping the localhost network from mail.ru, as in the image...

CVE-2018-10597: Improper Authentication

IntelliVue Patient Monitors MP Series including MP2/X2/MP30/MP50/MP70/NP90/MX700/800 Rev B-M, IntelliVue Patient Monitors MX MX400-550 Rev J-M and X3/MX100 for Rev M only, and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that...

CVE-2018-10599: Exposure of Sensitive Information to an Unauthorized Actor

IntelliVue Patient Monitors MP Series including MP2/X2/MP30/MP50/MP70/NP90/MX700/800 Rev B-M, IntelliVue Patient Monitors MX MX400-550 Rev J-M and X3/MX100 for Rev M only, and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that...

CVE-2018-10601: Stack-based Buffer Overflow

IntelliVue Patient Monitors MP Series including MP2/X2/MP30/MP50/MP70/NP90/MX700/800 Rev B-M, IntelliVue Patient Monitors MX MX400-550 Rev J-M and X3/MX100 for Rev M only, and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that...

PT-2018-9988

Name of the Vulnerable Software and Affected Versions: IntelliVue Patient Monitors MP Series versions Rev B-M IntelliVue Patient Monitors MX versions Rev J-M Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0, J.3 IntelliVue Patient Monitors X3/MX100 version Rev M...