CVE-2015-7214

CVE-2015-7214 CVE-2015-7214 とは？ 以下のリンクを参照してください。 data および view-source URI を介したクロスサイトリーディング攻撃 内容 www/index.html Web 用 SOP バイパス PoC local/index.html ローカル用 SOP バイパス PoC 必要条件 Firefox バージョン 42.0 以前 以下は各プラットフォーム向けの Firefox 42.0 のダウンロードリンクです。 Windows...

CVE-2017-7089

CVE-2017-7089 영향 : 악의적으로 조작된 웹 콘텐츠를 처리할 경우 범용 크로스 사이트 스크립팅이 발생할 수 있습니다. 설명 : parent-tab 처리에 논리적 문제가 있었습니다. 이 문제는 개선된 상태 관리로 해결되었습니다. Safari 10 로컬 SOP 우회 root@kitploit: function Pewvar doc=open'parent-tab://apple.com';doc.document.body.innerHTML='';Click me! Frans Rosén의 익스플로잇 root@kitploit:...

PT-2026-76989

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description A same-origin policy bypass exists within the DOM: Service Workers component. The same-origin...

[SECURITY] Fedora 44 Update: rust-sequoia-sop-0.37.3-4.fc44

An implementation of the Stateless OpenPGP Interface using Sequoia...

EUVD-2020-20461

Malware in sbrugna...

[SECURITY] Fedora 41 Update: rust-sequoia-sop-0.36.0-3.fc41

An implementation of the Stateless OpenPGP Interface using Sequoia...

Samsung Internet Browser SOP Bypass

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Samsung Internet Browser SOP Bypass', 'Description' = %q This module takes advantage of a Same-Origin Policy SOP bypass vulnerability in the...

RHEL 6 : icedtea-web (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - icedtea-web: SOP checks based on codebase and not applet origin CVE-2015-5236 Note that Nessus has not tested for...

CVE-2023-49803

The CVE concerns the @koa/cors middleware for koa (Node.js). Before version 5.0.0, if an allowed origin is not provided, the middleware returns Access-Control-Allow-Origin with the request’s origin, effectively bypassing the browser’s Same-Origin Policy and exposing cross-origin data as described...

Fedora: Security Advisory for rust-sequoia-sop (FEDORA-2023-1d0d71b6aa)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for rust-sequoia-sop (FEDORA-2023-c08ee112f6)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 38 : rust-sequoia-octopus-librnp / rust-sequoia-sop / rust-sequoia-sq (2023-c08ee112f6)

The remote Fedora 38 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-c08ee112f6 advisory. Rebuild for bzip2 0.4.4 CVE-2023-22895 / RUSTSEC-2023-0004. Tenable has extracted the preceding description block directly from the Fedora security advisory...

Fedora: Security Advisory for rust-sequoia-sop (FEDORA-2023-7bd6fbb5fa)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 36 : rust-sequoia-octopus-librnp / rust-sequoia-sop / rust-sequoia-sq (2023-7bd6fbb5fa)

The remote Fedora 36 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-7bd6fbb5fa advisory. Rebuild for bzip2 0.4.4 CVE-2023-22895 / RUSTSEC-2023-0004. Tenable has extracted the preceding description block directly from the Fedora security advisory...

Fedora: Security Advisory for rust-sequoia-sop (FEDORA-2023-c17427d18a)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Brave Software: Brave News feeds can open arbitrary chrome: URLs

An issue was discovered in Brave Browser versions 1.46.144 and earlier. The Brave News feeds feature can be exploited to open arbitrary chrome: URLs, bypassing the Same Origin Policy SOP and potentially granting access to privileged URLs. An attacker could use this vulnerability to gain...

CVE-2015-5236

It was discovered that the IcedTea-Web used codebase attribute of the tag on the HTML page that hosts Java applet in the Same Origin Policy SOP checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value...

CVE-2015-5236

It was discovered that the IcedTea-Web used codebase attribute of the tag on the HTML page that hosts Java applet in the Same Origin Policy SOP checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value...

CVE-2015-5236

The CVE-2015-5236 entry concerns IcedTea-Web, where the codebase attribute of the HTML tag used in the SOP check is not required to match the applet’s actual origin. This could allow a malicious site to bypass Same Origin Policy by spoofing the codebase value. Public documentation provided refer...

CVE-2015-5236

It was discovered that the IcedTea-Web used codebase attribute of the tag on the HTML page that hosts Java applet in the Same Origin Policy SOP checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value...