CVE-2015-5236

A flaw was discovered that IcedTea-Web did not properly determine an applet's origin when performing same-origin checks. A malicious page could use this flaw to bypass the Same Origin Policy SOP and access data on unrelated sites using a spoofed value for the applet's codebase attribute...

CVE-2020-27969

Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofing...

Spoofing

Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofing...

CVE-2020-27969

CVE-2020-27969 affects Yandex Browser for Android (version 20.8.4). Multiple sources describe a vulnerability enabling remote SOP bypass and address bar spoofing. The available connected documents note the software and impact but do not provide root-cause details or a published fix/remediation. I...

CVE-2020-27969

Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofing...

Mail.ru: Bypassing SOP with XSS on account.my.games leading to steal CSRF token and user information

Incorrect CORS settings on account.my.games, allowed access to user information registration IP, email, username, birthday, profile visibility from .my.com. Vulnerability demonstrated by XSS at warofdragons.my.games...

Brave Software: Onion-Location header allows to open arbitrary URLs including chrome:

The "Open in Tor" feature in Brave Nightly for OSX allowed arbitrary URLs to be opened through the Onion-Location response header, including privileged URLs such as chrome://restart/. This could be exploited to bypass SOP restrictions and gain access to privileged URLs...

KOFFEE - Kia OFFensivE Exploit

This module exploits CVE-2020-8539, which is an arbitrary code execution vulnerability that allows an to attacker execute the micomd binary file on the head unit of Kia Motors. This module has been tested on SOP.003.30.18.0703, SOP.005.7.181019 and SOP.007.1.191209 head unit software versions. Th...

Kia Motors Head Unit Access Control Error Vulnerability

Kia Motors Head Unit is the main unit of a car from the Korean company Kia Kia. The unit is used in the vehicle-machine interaction process. The Kia Motors Head Unit suffers from an Access Control Error vulnerability that can be exploited by an attacker to inject unauthorized commands to trigger...

Windowsrcer IE/Edge Cross-URL vulnerabilities

Cross-Origin bugs in IE and Edge allow bypassing SOP in both browsers. 0-days released by James Lee @Windowsrcer Recent assessments: busterb at August 21, 2019 4:31pm UTC reported: A SOP bug requires the attacker to inject a resource into one domain, and be listening on another. Such a...

BTFS: misconfigured CORS let to HPP and SOP bypass

Hello team, I found a bug on your website that let me bypass the SOP policy. Hope you fix it, everything is in the video https://www.youtube.com/watch?v=PYsU350S-s4 Impact The attacker my direct a victim to a phishing page of www.bitterrent.com/login and he/she will be convince to enter their ema...

Critical: Red Hat Security Advisory: chromium-browser security update

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 77 to the Stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 77.0.3865.75 contains a number of fixes and improvements -- a full list of changes in this build is available in the log. Wat...

17 years not to fix Firefox local file stealing vulnerability analysis-vulnerability warning-the black bar safety net

Recently, security researchers Barak Tawily of the homologous policy the Same Origin Policy attack carried out research and found that the Firefox browser due to file scheme URI to the same origin policy of improperly implemented, will lead to Firefox browser by the local file theft attack. Attac...

Mail.ru: Reflected cross site scripting at https://auto.mail.ru/reviews/add_review/ via problems_text parameter.

Description https://auto.mail.ru is vulnerable for xss. It is possible for an attacker to inject arbitrary JavaScript in application response Step to reproduce 1. Open the below link in Firefox...

Brave Software: chrome://brave navigation from web

Summary: It's possible to navigate to the infamous 'chrome://brave' and all other privileged page from web, requiring only a single click. This is possible by opening popups with the 'noopener' attribute. Products affected: Brave: 0.24.0 V8: 6.9.427.23 rev: f657f15bf7e0e0c50a2b854c6b05edb59bfc556...

Brave Software: Navigation to restricted origins via "Open in new tab"

Summary: It's possible to open links pointing to file:/// origin from web pages using "Open link in a new tab" in context menu. https://hackerone.com/bugs?reportid=369185 shows unsafe ssh:// protocol handling, which leads to information leak using sshOS username and etc.. The vulnerability is...

Samsung Internet Browser 6.2.01.12 SOP Bypass / UXSS Vulnerabilities

Samsung Internet Browser version 6.2.01.12 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code. From: https://poctestblog.blogspot.co.uk/2017/12/samsung-internet-browser-sop-bypassuxss.html Samsung Internet Browser SOP Bypass/UXSS...

Samsung Internet Browser 6.2.01.12 SOP Bypass / UXSS

Samsung Internet Browser SOP Bypass/UXSS There is a Same Origin Policy bypass / Universal Cross Site Scripting issue in Samsung Internet Browser tested on latest version - 6.2.01.12. First of all, using the combination of MHTML and XSLT ends up resulting in a weird interaction. When you create an...

Samsung Internet Browser SOP Bypass (CVE-2017-17692)

A SOP bypass vulnerability exists within the Samsung internet browser. This vulnerability is due to the way the browser handles its same origin policy. A successful attack could lead to stolen information...