909 matches found
[SECURITY] [DSA 5282-1] firefox-esr security update
------------------------------------------------------------------------- Debian Security Advisory DSA-5282-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 16, 2022 https://www.debian.org/security/faq -...
CVE-2022-45410
The Mozilla Foundation Security Advisory describes this flaw as: When a ServiceWorker intercepted a request with FetchEvent, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec...
Mozilla Firefox Security Advisory (MFSA2022-47) - Mac OS X
Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...
Mozilla Firefox ESR Security Advisories (MFSA2022-47, MFSA2022-49) - Mac OS X
Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...
CVE-2022-45413
Using the S.browserfallbackurl parameter parameter, an attacker could redirect a user to a URL and cause SameSite=Strict cookies to be sent.This issue only affects Firefox for Android. Other operating systems are not affected.. This vulnerability affects Firefox 107...
CVE-2022-45410
When a ServiceWorker intercepted a request with FetchEvent, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec and then in browsers. This vulnerability affects Firefox ESR...
Mozilla Firefox < 107.0
The version of Firefox installed on the remote Windows host is prior to 107.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-47 advisory. - Mozilla developers Gabriele Svelto, Yulia Startsev, Andrew McCreight and the Mozilla Fuzzing Team reported memory safe...
Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 102.2ESR) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF16 - 2022.4.0
Summary Synthetic Playback Agent has addressed the following vulnerabilities: CVE-2022-29912, CVE-2022-38473, CVE-2022-29914, CVE-2022-38476, CVE-2022-38477, CVE-2022-34470, CVE-2022-29911, CVE-2022-29917, CVE-2022-31739, CVE-2022-34481, CVE-2022-38478, CVE-2022-34478, CVE-2022-31738,...
PT-2022-5648
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 107 Firefox ESR versions prior to 102.5 Thunderbird versions prior to 102.5 Description The issue is related to errors in security settings in the Service Workers service of Mozilla Firefox, Firefox ESR, and the...
Mozilla Firefox input validation error vulnerability
Mozilla Firefox is an open source Web browser from the Mozilla Foundation in the U.S. Mozila Firefox is vulnerable to an input validation error that could be exploited by an attacker to redirect a user to a URL and cause a SameSite=Strict cookie to be sent...
Mozilla Firefox security vulnerabilities
Mozilla Firefox is an open source web browser from the Mozilla Foundation. Mozila Firefox has a security vulnerability that can be exploited by attackers to cause SameSite cookie protection to fail...
Security Vulnerabilities fixed in Firefox ESR 102.5 — Mozilla
Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range requests might have allowed them to determine the presence or length of a media file. Through a series of popup and window.print calls, an...
Yelp: If the website does not impose additional defense against CSRF attacks, failing to use the 'Lax' or 'Strict' values could increase the risk of exposur
Summary: Cookies are typically sent to third parties in cross-origin requests. This can be abused to do CSRF attacks. Recently a new cookie attribute named SameSite was proposed to disable third-party usage for some cookies, to prevent CSRF attacks. Same-site cookies allow servers to mitigate the...
Cookies generated by VPN Vserver lack Secure/SameSite/HttpOnly flags
Cookies generated by VPN Vserver lack Secure/SameSite/HttpOnly flags...
CSRF resulting in Account Takeover
Description Hello everyone, Rdiffweb offers a profile section where the admin user can change his informations such as the username, the email etc..., when the admin changes his username and his email; the following POST requests is sent: POST /prefs/general HTTP/1.1 Host:...
GHSA-5HM8-VH6R-2CJQ CodeIgniter Shield Vulnerable to SameSite Attackers Bypassing the CSRF Protection
Impact This vulnerability may allow SameSite Attackers to bypass the CodeIgniter4 CSRF protection mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct or indirect, e.g., XSS control over a subdomain site e.g., https://a.example.com/ of the target site e.g.,...
CodeIgniter Shield Vulnerable to SameSite Attackers Bypassing the CSRF Protection
Impact This vulnerability may allow SameSite Attackers to bypass the CodeIgniter4 CSRF protection mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct or indirect, e.g., XSS control over a subdomain site e.g., https://a.example.com/ of the target site e.g.,...
CVE-2022-35943
Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow SameSite Attackers to bypass the CodeIgniter4 CSRF protection mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct or indirect, e.g., XSS control over a...
Authentication flaw
Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow SameSite Attackers to bypass the CodeIgniter4 CSRF protection mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct or indirect, e.g., XSS control over a...
CVE-2022-35943
Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow "SameSite Attackers" https://canitakeyoursubdomain.name/ to bypass the "CodeIgniter4 CSRF protection" https://codeigniter4.github.io/userguide/libraries/security.html mechanism with CodeIgniter...