U.S. Dept Of Defense: Firewall rules for ████████ can be bypassed to leak site authors

Summary: ████ is a WordPress application that has several endpoints locked behind firewall, such as login screen and author names, but it can be bypassed. Description: By using additional slashes in the URL, I can bypass the firewall rules to display some WordPress information. Interestingly, the...

Character encoding cross-origin XSS attack — Mozilla

Security researcher Masato Kinugawa discovered that if a web page is missing character set encoding information it can inherit character encodings across navigations into another domain from an earlier site. Only same-origin inheritance is allowed according to the HTML5 specification. This issue...