Archive
2 June 2023
Vulnerabilities first published on this day (UTC), newest first.
52 results · Clear filters · Feed
-
Medium 6.5
Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers
A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers. This vulnerability affects Firefox < 109, Fi…
-
Medium 6.5
Calls to console.log allowed bypassing Content Security Policy via format directive
Regular expressions used to filter out forbidden properties and values from style directives in calls to `console.log` weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser. This vulnerability affects Firefox < 109,…
-
Medium 6.5
Creation of duplicate SystemPrincipal from less secure contexts
A duplicate `SystemPrincipal` object could be created when parsing a non-system html document via `DOMParser::ParseFromSafeString`. This could have lead to bypassing web security checks. This vulnerability affects Firefox < 109.
-
Medium 4.3
Android applications with unpatched vulnerabilities can be launched from a browser using Intents, exposing users to the…
-
Medium 5.7
Status Internet Co.,Ltd. PowerBPM - Broken Access Control
It is identified a vulnerability of insufficient authentication in an important specific function of Status PowerBPM. A LAN attacker with normal user privilege can exploit this vulnerability to modify substitute agent to arbitrary users, resulting in serious …
-
Medium 5.4
A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser i…
-
Medium 6.5
When dragging and dropping an image cross-origin, the image's size could potentially be leaked. This behavior was shipp…
-
Medium 6.5
Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have res…
-
Medium 4.3
By displaying a prompt with a long description, the fullscreen notification could have been hidden, resulting in potent…
-
Medium 4.3
Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private brow…
-
Medium 6.5
The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted…
-
Medium 4.3
Bluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device information for Bluetoot…