CVE-2013-7324

WebKit-GTK 2.x (any version with HTML5 audio/video support based on GStreamer) is reported to allow remote attackers to trigger unexpectedly high sound volume through malicious JavaScript. The description notes this behavior complies with existing W3C standards and GNOME desktop integration pract...

CVE-2013-7324

Webkit-GTK 2.x any version with HTML5 audio/video support based on GStreamer allows remote attackers to trigger unexpectedly high sound volume via malicious javascript. NOTE: this WebKit-GTK behavior complies with existing W3C standards and existing practices for GNOME desktop integration...

Directive injection when using dynamic overrides with user input

Impact If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in...

CVE-2019-11743

Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload event, which restricts access to detailed timing attributes to only be same-origin. This resulted in potential cross-origin information exposure of history throu...

Mozilla: Cross-origin access to unload event attributes

Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload event, which restricts access to detailed timing attributes to only be same-origin. This resulted in potential cross-origin information exposure of history throu...

Cross Origin Access

firefox is vulnerable to cross-origin access. The vulnerability exists due to not the adhering to the W3C's Navigation-Timing Level 2 which allows an attacker to do potential cross-origin information exposure of history via timing side-channel attacks...

Security vulnerabilities fixed in - Thunderbird 68.1 — Mozilla

Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This results in a potentially exploitable crash. Some...

Security vulnerabilities fixed in - Thunderbird 60.9 — Mozilla

Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This results in a potentially exploitable crash. Some...

CVE-2019-11743

Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload event, which restricts access to detailed timing attributes to only be same-origin. This resulted in potential cross-origin information exposure of history throu...

Security vulnerabilities fixed in Firefox 69 — Mozilla

Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks on malicious links in a chat application. This can be used to write a log file to an arbitrary location such as the Windows 'Startup' folder. Note: this issue...

Security vulnerabilities fixed in Firefox ESR 60.9 — Mozilla

A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This results in a potentially exploitable crash. Some HTML elements, such as and , can contain literal angle brackets without treating them as markup. It is possible to pass a liter...

Android Users Can Now Log in to Google Services Using Fingerprint

If you're using Chrome on Android, you can now sign-in to your Google account and some of the other Google services by simply using your fingerprint, instead of typing in your password every time. Google is rolling out a new feature, called "local user verification," that allows you to log in to...

Privilege Escalation

An attack technique against the W3C XML Encryption Standard when block ciphers were used in CBC mode could allow a remote attacker to conduct chosen-ciphertext attacks, leading to the recovery of the entire plain text of a particular cryptogram. CVE-2011-1096 JBoss Web Services leaked side-channe...

Privilege Escalation

An attack technique against the W3C XML Encryption Standard when block ciphers were used in CBC mode could allow a remote attacker to conduct chosen-ciphertext attacks, leading to the recovery of the entire plain text of a particular cryptogram. CVE-2011-1096 JBoss Web Services leaked side-channe...

Information Disclosure

An attack technique against the W3C XML Encryption Standard when block ciphers were used in CBC mode could allow a remote attacker to conduct chosen-ciphertext attacks, leading to the recovery of the entire plain text of a particular cryptogram. CVE-2011-1096 JBoss Web Services leaked side-channe...

Cross Site Scripting (XSS)

An attack technique against the W3C XML Encryption Standard when block ciphers were used in CBC mode could allow a remote attacker to conduct chosen-ciphertext attacks, leading to the recovery of the entire plain text of a particular cryptogram. CVE-2011-1096 JBoss Web Services leaked side-channe...

Storefront 3.15 | Storefront propagation fails.

Propagation fails on Server 2012R2 machine. In event logs: Log Name: Citrix Delivery Services Source: Citrix Configuration Replication An error occurred when starting the 'WAS' Windows service. System.ServiceProcess.TimeoutException, System.ServiceProcess, Version-4.0.0.0, Culture=neutral,...

[SECURITY] Fedora 27 Update: axis-1.4-35.fc27

Apache AXIS is an implementation of the SOAP "Simple Object Access Protoco l" submission to W3C. From the draft W3C specification: SOAP is a lightweight protocol for exchange of information in a decentraliz ed, distributed environment. It is an XML based protocol that consists of three parts: an...

[SECURITY] Fedora 25 Update: inkscape-0.92.1-4.20170510bzr15686.fc25.1

Inkscape is a vector graphics editor, with capabilities similar to Illustrator, CorelDraw, or Xara X, using the W3C standard Scalable Vector Graphics SVG file format. It is therefore a very useful tool for web designers and as an interchange format for desktop publishing. Inkscape supports many...

Tim Berners-Lee, Inventor of the Web, Wins $1 Million Turing Award 2016

Sir Tim Berners-Lee — the inventor of the World Wide Web — has won this year's A.M. Turing Award, which is frequently described as the "Nobel Prize of Computing," by the Association for Computing Machinery ACM. Turing Award is named after Alan Mathison Turing, the British mathematician and comput...