Annevk

The issue is related to insufficient protection of service data when processing the Vary header response for matching request headers. An attacker can exploit this by sending iterative requests to learn the size of an opaque response and the contents of a server-supplied Vary header, potentially allowing unauthorized access to protected information.

The issue is related to a lack of protection for service data, allowing a remote attacker to bypass existing access restrictions and execute a redirect to a specified URL using specially crafted JavaScript code. This can be achieved when a user performs a drag-and-drop action of an image into a TEXTBOX element, allowing the attacker to discover the target URL of a redirect.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a multibyte character set. This can be exploited by remote attackers.