Takeshi Terada

O problema está relacionado ao recurso de Criptografia Oportunística do HTTP2, que permite que uma conexão seja atualizada para TLS enquanto mantém as propriedades visuais de uma conexão HTTP. Um invasor de rede poderia explorar isso redirecionando uma conexão do navegador para uma porta diferente, fazendo com que o navegador trate o conteúdo como sendo da mesma origem com HTTP. Isso poderia permitir que um invasor remoto contornasse as restrições de segurança.

O problema está relacionado à renderização de Folhas de Estilo em Cascata (CSS), o que pode levar a ataques de Cross-Site Scripting (XSS). O XSS é um tipo de ataque em que um invasor injeta scripts maliciosos em um site, permitindo-lhe roubar dados do usuário ou assumir o controle da sessão do usuário.

A security issue exists where Android intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs to local "file:" URLs. This allows for the reading of local data through a violation of same-origin policy. The issue only affects Firefox for Android and does not impact other operating systems.

The issue allows for a cross-site scripting (XSS) attack when a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL. Triggering a reload will run the reloaded "data:text/html" page with its origin set incorrectly. This vulnerability is related to the failure to protect the structure of a web page, which can be exploited by a remote attacker to conduct XSS attacks by redirecting to a "data:text/html" URL.

The issue allows remote attackers to inject arbitrary web script or HTML via a crafted HTTP/0.9 response, related to a cross-protocol cross-site scripting (XPXSS) vulnerability. This is due to the lack of protection for the web page structure in the WebKit JavaScript component.

A cross-site scripting (XSS) issue exists in the WebKit Page Loading implementation, allowing remote attackers to inject arbitrary web script or HTML via an HTTP response that specifies redirection, which is mishandled by Safari.

The issue exists due to insufficient input validation in the Apache Struts platform. This allows a remote attacker to bypass existing access restrictions by utilizing a default method, potentially conducting redirection attacks.

The issue is related to the lack of protection for service data in the WebKit component's XSS auditor. This allows a remote attacker to obtain sensitive information using a specially crafted URL. The problem arises from the improper handling of redirects in block mode.

The issue allows attackers to inject arbitrary SMTP commands via CRLF sequences in an email address to the `validateAddress` function in class.phpmailer.php or an SMTP command to the `sendCommand` function in class.smtp.php. This can be exploited by injecting line breaks into valid email addresses, which are not handled correctly in some contexts.

The issue allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized data, due to the reliance on client-side object storage without proper checks.

The issue allows remote attackers to execute arbitrary PHP code via a `language="php"` attribute of a `SCRIPT` element. Applications with ESI support enabled and using the Symfony built-in reverse proxy are vulnerable to PHP code injection. A malicious user can inject PHP code that will be executed by the server. The vulnerability comes from the use of `eval()` to execute files in the cache when they contain ESI tags, and the fact that PHP allows contents of `<script language="php">` tags to be executed. This issue can be exploited in combination with Cross-Site Scripting vulnerabilities, allowing an attacker to conduct a PHP code injection attack by passing a malicious tag in a user-submitted variable.

The issue allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code. This can be achieved via the `do` parameter. There is a report of this issue being used for unauthenticated remote code execution (RCE).

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML.

The issue is related to the ParametersInterceptor in Apache Struts, which does not properly restrict access to the getClass method. This allows remote attackers to manipulate the ClassLoader and execute arbitrary code via a crafted request. The vulnerability exists due to an incomplete fix for a previous issue. It is related to the implementation of the getClass method, which has access control deficiencies when using the ParametersInterceptor with the class parameter. Exploitation of this vulnerability can allow a remote attacker to execute arbitrary code by sending a specially crafted request.

The issue is related to the CookieInterceptor in Apache Struts, where an incomplete fix for a previous issue has led to a vulnerability. This vulnerability allows remote attackers to manipulate the ClassLoader and execute arbitrary code via a crafted request, due to insufficient access restrictions when handling wildcard cookiesName values. The exploitation requires the application to be configured to accept all cookies, allowing access to the class parameter directly mapped to the getClass() method.

The issue allows attackers to bypass the Same Origin Policy, which can lead to cross-site scripting (XSS) attacks or the unauthorized obtaining of password or cookie information. This is achieved by using a symlink in conjunction with a file: URL for a local file.

The issue is related to the implementation of the DefaultActionMapper mechanism in Apache Struts, which is associated with insufficient input validation when processing parameters with the `redirect:` or `redirectAction:` prefix. This can be exploited by remote attackers to conduct phishing attacks via a specially crafted URL. The vulnerability allows attackers to redirect users to arbitrary web sites.

The issue is related to the improper sanitization of input data in the DefaultActionMapper mechanism of Apache Struts. This allows a remote attacker to execute arbitrary OGNL expressions by crafting parameters with specific prefixes, such as `action:`, `redirect:`, or `redirectAction:`. The vulnerability can be exploited to execute server-side code.

The issue allows remote attackers to obtain sensitive information via a crafted URL, which is not properly handled during interaction with other applications.

The issue is related to improper access restriction from JavaScript code to Android APIs. This allows remote attackers to have an unspecified impact via a crafted web page.