Windowsrcer

The issue is related to inappropriate implementation in iOS, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This is due to insufficient access control, which can be exploited by a remote attacker to gain unauthorized access to protected information. The estimated number of potentially affected devices worldwide is not specified.

The issue was addressed with improved UI handling. A malicious website may exfiltrate audio data cross-origin.

A logic issue was addressed with improved checks. A malicious website may cause unexpected cross-origin behavior. The issue is related to insufficient access control in WebKitGTK and WPE WebKit modules, which can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

The webkit2gtk and webkit2gtk3 engines contain a type confusion flaw. This issue is actively exploited and may allow an attacker to execute arbitrary code by tricking a user into viewing a malicious website. Apple has addressed this vulnerability in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, iOS 16.7.5, iPadOS 16.7.5, and macOS Monterey 12.7.3. The vulnerability exists in WebKit, the browser engine used by Safari.

The issue is related to an inappropriate implementation in Navigation, allowing a remote attacker to spoof the contents of the modal dialogue via a crafted HTML page. This can be achieved by exploiting a vulnerability associated with improperly implemented security checks for standard elements. The estimated number of potentially affected devices and details about real-world incidents are not provided.

The issue is related to errors in the representation of information by the user interface in Microsoft Edge's IE Mode. It may allow a remote attacker to conduct spoofing attacks.

The issue is related to an inappropriate implementation in Navigation in Google Chrome on Windows, which allowed a remote attacker to inject scripts or HTML into a privileged page via a crafted HTML page. This could enable the attacker to bypass existing security restrictions.

The issue is related to insufficient filtering in URI schemes, allowing a remote attacker to bypass navigation restrictions. This could potentially enable the execution of arbitrary JavaScript code.

A cross-origin issue existed with the fetch API, which has been addressed with improved input validation. Processing maliciously crafted web content may disclose sensitive user information. The issue is related to insufficient input validation in the WebKit display module, allowing a remote attacker to gain unauthorized access to protected information.

Name of the Vulnerable Software and Affected Versions: Safari versions prior to 12.0.2 iOS versions prior to 12.1.1 tvOS versions prior to 12.1.1 iTunes versions prior to 12.9.2 for Windows Description: A logic issue related to state management may disclose sensitive user information when processing maliciously crafted web content. This issue allows attackers to obtain sensitive user information via maliciously crafted web content. Recommendations: For Safari versions prior to 12.0.2, update to Safari 12.0.2 or later. For iOS versions prior to 12.1.1, update to iOS 12.1.1 or later. For tvOS versions prior to 12.1.1, update to tvOS 12.1.1 or later. For iTunes versions prior to 12.9.2 for Windows, update to iTunes 12.9.2 for Windows or later.

A logic issue was addressed with improved state management. Processing maliciously crafted web content may disclose sensitive user information.

An information disclosure issue exists in the way Microsoft Edge handles cross-origin requests. This could allow an attacker to determine the origin of all web pages in the affected browser.

The issue is related to the improper disclosure of file information by Windows Media Player, allowing a remote attacker to determine the presence of files on a disk using a specially crafted hyperlink. This can lead to the exposure of sensitive information.

The issue is related to errors in the mechanisms for processing objects in memory in the Windows Media Player component of the Windows operating system. Exploitation of this issue may allow a remote attacker to access confidential information using a specially crafted hyperlink. It is an information disclosure vulnerability that exists when Windows Media Player improperly discloses file information.

An information disclosure issue exists due to the incorrect handling of a filtered response type by the Microsoft Edge Fetch API. This could allow a remote attacker to disclose protected information. Specifically, an attacker could use this issue to read the URL of a cross-origin request. If websites do not securely populate the URL with confidential information, it could lead to information disclosure.

A same-origin policy violation exists, allowing the theft of cross-origin URL entries. This occurs when a page uses a meta http-equiv="refresh" to cause a redirection to another site, exploiting the performance.getEntries() function. This could enable data theft.

An elevation of privilege issue exists in Microsoft browsers, allowing sandbox escape. This could enable an attacker to elevate privileges on an affected system. The vulnerability by itself does not allow arbitrary code execution but could be used in combination with another vulnerability to run arbitrary code.

The issue is related to errors in the implementation of cross-frame interaction in Microsoft browsers. It allows a remote attacker to disclose protected information using a specially crafted web page. An attacker who successfully exploits this issue could obtain browser frame or window state from a different domain.