Next Page >>
same/origin policy
names in subjectAltName:dNSName fields (CVE-2008-2809).
The following vulnerabilities were reported in Firefox, SeaMonkey and
XULRunner:
* moz_bug_r_a4 reported that the Same Origin Policy is not properly
enforced on JavaScript (CVE-2008-2800).
* Collin Jackson and Adam Barth reported that JAR signing is not
properly implemented, allowing injection of JavaScript into documents
within a JAR archive (CVE-2008-2801).
CVE-2009-1697
CRLF injection vulnerability in WebKit allows remote attackers to inject HTTP
headers and bypass the Same Origin Policy via a crafted HTML document, related
to cross-site scripting (XSS) attacks that depend on communication with
arbitrary web sites on the same server through use of XMLHttpRequest without a
Host header.
FLOCK-SA-2010-04
http://flock.com/security/
Title: window.open() Method Javascript Same-Origin Policy
Violation (XSS)
Impact: High
Announced on: 2010-09-09
IcedTea6 prior to 1.10.4 allows remote untrusted Java Web Start
applications and untrusted Java applets to affect confidentiality
and integrity, related to JSSE (CVE-2011-3560).
Deepak Bhole discovered a flaw in the Same Origin Policy (SOP)
implementation in the IcedTea project Web browser plugin. A
malicious applet could use this flaw to bypass SOP protection and
open connections to any sub-domain of the second-level domain of
the applet's origin, as well as any sub-domain of the domain that
is the suffix of the origin second-level domain. For example,
CVE-2010-3178
Xulrunner does not properly handle certain modal calls made by
javascript: URLs in circumstances related to opening a new
window and performing cross-domain navigation, which allows
remote attackers to bypass the Same Origin Policy via a
crafted HTML document.
CVE-2010-3179
Stack-based buffer overflow in the text-rendering
functionality in Xulrunner allows remote attackers to execute
Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird
before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 do
not properly handle certain modal calls made by javascript: URLs
in circumstances related to opening a new window and performing
cross-domain navigation, which allows remote attackers to bypass the
Same Origin Policy via a crafted HTML document (CVE-2010-3178).
Stack-based buffer overflow in the text-rendering functionality in
Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird
before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 allows
remote attackers to execute arbitrary code or cause a denial of service
Abstract
"Transparent proxies allow organizations to influence and monitor the traffic from its users without their knowledge
or participation. Transparent proxies act as intermediaries between a user and end destination, and aren't generally
apparent to users sitting behind them. Enterprises, Hotels, and Internet Service Providers often use transparent proxy
products to lower bandwidth consumption,speed up page loads for their users, and for monitoring and filtering of web
surfing. When certain transparent proxy architectures are in use an attacker can achieve a partial Same Origin Policy
Bypass resulting in access to any host reachable by the proxy via the use of client plug-in technologies (such as Flash,
Applets, etc) with socket capabilities. This write up will describe this architecture, how it may be abused by Flash,
its existence in various network layouts, and mitigations."
Paper Link:
The importScripts Web Worker method in Mozilla Firefox 3.5.x before
3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and
3.1.x before 3.1.1, and SeaMonkey before 2.0.6 does not verify that
content is valid JavaScript code, which allows remote attackers to
bypass the Same Origin Policy and obtain sensitive information via
a crafted HTML document (CVE-2010-1213).
Integer overflow in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x
before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before
3.1.1, and SeaMonkey before 2.0.6 allows remote attackers to execute
CVE-2011-0778
WebKit does not properly restrict drag and drop operations, which might allow
remote attackers to bypass the Same Origin Policy via unspecified vectors.
For the stable distribution (squeeze), these problems have been fixed
in version 1.2.7-0+squeeze1
attacker could exploit this to crash Thunderbird or possibly run arbitrary
code as the user invoking the program. (CVE-2010-2760, CVE-2010-2767,
CVE-2010-3167)
It was discovered that the XPCSafeJSObjectWrapper (SJOW) security wrapper
did not always honor the same-origin policy. If JavaScript was enabled, an
attacker could exploit this to run untrusted JavaScript from other domains.
(CVE-2010-2763)
Matt Haggard discovered that Thunderbird did not honor same-origin policy
when processing the statusText property of an XMLHttpRequest object. If a
Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird
before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 do
not properly handle certain modal calls made by javascript: URLs
in circumstances related to opening a new window and performing
cross-domain navigation, which allows remote attackers to bypass the
Same Origin Policy via a crafted HTML document (CVE-2010-3178).
Stack-based buffer overflow in the text-rendering functionality in
Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird
before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 allows
remote attackers to execute arbitrary code or cause a denial of service
Daniel Veditz discovered that the Content-Disposition: header is ignored
within the jar: URI scheme.
CVE-2009-1307
Gregory Fleischer discovered that the same-origin policy for Flash files
is inproperly enforced for files loaded through the view-source scheme,
which may result in bypass of cross-domain policy restrictions.
CVE-2009-1308
attacker could exploit this to crash Thunderbird or possibly run arbitrary
code as the user invoking the program. (CVE-2010-2760, CVE-2010-2767,
CVE-2010-3167)
It was discovered that the XPCSafeJSObjectWrapper (SJOW) security wrapper
did not always honor the same-origin policy. If JavaScript was enabled, an
attacker could exploit this to run untrusted JavaScript from other domains.
(CVE-2010-2763)
Matt Haggard discovered that Thunderbird did not honor same-origin policy
when processing the statusText property of an XMLHttpRequest object. If a
Several vulnerabilities have been discovered in OpenJDK, an
implementation of the Oracle Java platform.
CVE-2011-3377
The Iced Tea browser plugin included in the openjdk-6 package
does not properly enforce the Same Origin Policy on web content
served under a domain name which has a common suffix with the
required domain name.
CVE-2011-3563
The Java Sound component did not properly check for array
vectors (CVE-2011-2997).
Mozilla Firefox before 3.6.23 and 4.x through 5, Thunderbird before
6.0, and SeaMonkey before 2.3 do not properly handle location as the
name of a frame, which allows remote attackers to bypass the Same
Origin Policy via a crafted web site, a different vulnerability than
CVE-2010-0170 (CVE-2011-2999).
Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before
7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses
that contain multiple Location, Content-Length, or Content-Disposition
+------------+
This vulnerability can be exploited in several ways.
As the injection point is in the chrome privileged
browser zone, it is possible to bypass Same Origin
Policy (SOP) protections, and also access Mozilla
built-in XPCOM components. XPCOM components can be
used to read and write from the file system, as well
as execute arbitrary commands, steal stored passwords,
or modify other Firefox extensions.
CVE-2011-2999
Boris Zbarsky discovered that incorrect handling of the
window.location object could lead to bypasses of the same-origin
policy.
CVE-2011-3000
Ian Graham discovered that multiple Location headers might lead to
CRLF injection.
Hi folks,
Firefox 3.6.13 fixes an interesting bug in their same-origin policy
logic for pseudo-URLs that do not have any inherent origin associated
with them. These documents are normally expected to inherit the
context from their parent, or be assigned a unique one. This didn't
work as expected in Firefox, apparently due to a code refactoring in
2008. The vulnerability permits malicious websites to access and
modify the contents of special pages such as about:neterror or
about:config, which has consequences ranging from content spoofing to
Robert Swiecki discovered that Firefox did not properly validate Gopher
URLs. If a user were tricked into opening a crafted file via Gopher, an
attacker could possibly run arbitrary JavaScript. (CVE-2010-3177)
Eduardo Vela Nava discovered that Firefox could be made to violate the
same-origin policy by using modal calls with JavaScript. An attacker could
exploit this to steal information from another site. (CVE-2010-3178)
Dmitri GribenkoDmitri Gribenko discovered that Firefox did not properly
setup the LD_LIBRARY_PATH environment variable. A local attacker could
exploit this to execute arbitrary code as the user invoking the program.
large RegExp expression (CVE-2011-2998).
Mozilla Firefox before 3.6.23 and 4.x through 5, Thunderbird before
6.0, and SeaMonkey before 2.3 do not properly handle location as the
name of a frame, which allows remote attackers to bypass the Same
Origin Policy via a crafted web site, a different vulnerability than
CVE-2010-0170 (CVE-2011-2999).
Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before
7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses
that contain multiple Location, Content-Length, or Content-Disposition
+------------+
This vulnerability can be exploited in several ways.
As the injection point is in the chrome privileged
browser zone, it is possible to bypass Same Origin
Policy (SOP) protections, and also access Mozilla
built-in XPCOM components. XPCOM components can be
used to read and write from the file system, as well
as execute arbitrary commands, steal stored passwords,
or modify other Firefox extensions.
+------------+
This vulnerability can be exploited in several ways.
As the injection point is in the chrome privileged
browser zone, it is possible to bypass Same Origin
Policy (SOP) protections, and also access Mozilla
built-in XPCOM components. XPCOM components can be
used to read and write from the file system, as well
as execute arbitrary commands, steal stored passwords,
or modify other Firefox extensions.
+------------+
This vulnerability can be exploited in several ways.
As the injection point is in the chrome privileged
browser zone, it is possible to bypass Same Origin
Policy (SOP) protections, and also access Mozilla
built-in XPCOM components. XPCOM components can be
used to read and write from the file system, as well
as execute arbitrary commands, steal stored passwords,
or modify other Firefox extensions.
JavaScript code with chrome privileges (CVE-2009-3374).
Security researcher Gregory Fleischer reported that text within a
selection on a web page can be read by JavaScript in a different domain
using the document.getSelection function, violating the same-origin
policy. Since this vulnerability requires user interaction to exploit,
its severity was determined to be moderate (CVE-2009-3375).
Mozilla security researchers Jesse Ruderman and Sid Stamm reported
that when downloading a file containing a right-to-left override
character (RTL) in the filename, the name displayed in the dialog
+------------+
This vulnerability can be exploited in several ways.
As the injection point is in the chrome privileged
browser zone, it is possible to bypass Same Origin
Policy (SOP) protections, and also access Mozilla
built-in XPCOM components. XPCOM components can be
used to read and write from the file system, as well
as execute arbitrary commands, steal stored passwords,
or modify other Firefox extensions.
Blake Kaplan and Michal Zalewski discovered several weaknesses in the
XPCSafeJSObjectWrapper (SJOW) security wrapper. If a user were tricked into
viewing a malicious site, a remote attacker could use this to run arbitrary
JavaScript with chrome privileges. (CVE-2010-2762)
Matt Haggard discovered that Firefox did not honor same-origin policy when
processing the statusText property of an XMLHttpRequest object. If a user
were tricked into viewing a malicious site, a remote attacker could use
this to gather information about servers on internal private networks.
(CVE-2010-2764)
Security researcher Hidetake Jo of Microsoft Vulnerability Research
reported that the properties set on an object passed to showModalDialog
were readable by the document contained in the dialog, even when
the document was from a different domain. This is a violation of the
same-origin policy and could result in a website running untrusted
JavaScript if it assumed the dialogArguments could not be initialized
by another site. An anonymous security researcher, via TippingPoint's
Zero Day Initiative, also independently reported this issue to Mozilla
(CVE-2009-3988).
Jesse Ruderman and Sid Stamm discovered spoofing vulnerability
in the file download dialog.
CVE-2009-3375
Gregory Fleischer discovered a bypass of the same-origin policy
using the document.getSelection() function.
CVE-2009-3374
"moz_bug_r_a4" discovered a privilege escalation to Chrome status
CVE-2011-2999
Boris Zbarsky discovered that incorrect handling of the
window.location object could lead to bypasses of the same-origin
policy.
CVE-2011-3000
Ian Graham discovered that multiple Location headers might lead to
CRLF injection.
JavaScript code with chrome privileges (CVE-2009-3374).
Security researcher Gregory Fleischer reported that text within a
selection on a web page can be read by JavaScript in a different domain
using the document.getSelection function, violating the same-origin
policy. Since this vulnerability requires user interaction to exploit,
its severity was determined to be moderate (CVE-2009-3375).
Mozilla security researchers Jesse Ruderman and Sid Stamm reported
that when downloading a file containing a right-to-left override
character (RTL) in the filename, the name displayed in the dialog
Next Page>>
|
