UBUNTU-CVE-2017-7788

When an "iframe" has a "sandbox" attribute and its content is specified using "srcdoc", that content does not inherit the containing page's Content Security Policy CSP as it should unless the sandbox attribute included "allow-same-origin". This vulnerability affects Firefox 55...

Microsoft Internet Explorer Local Filename Information Disclosure Vulnerability

Internet Explorer is a web browser from Microsoft. Microsoft Internet Explorer has different feedback in the file:// URL for existing and non-existing files, and if used in conjunction with an HTML5 sandbox iframe, a local attacker could exploit this vulnerability to obtain local file existence...

CVE-2016-3321

Microsoft Internet Explorer 10 and 11 load different files for attempts to open a file:// URL depending on whether the file exists, which allows local users to enumerate files via vectors involving a file:// URL and an HTML5 sandbox iframe, aka "Internet Explorer Information Disclosure...

The vulnerability of Thunderbird software allows a malicious attacker to compromise the confidentiality and integrity of protected information.

The vulnerability exists in Mozilla Firefox and Thunderbird due to the incorrect implementation of the sandbox attribute for the IFRAME element. Exploiting this vulnerability allows malicious actors to circumvent content restrictions from a single same-origin source, by using a specially crafted...