Johan Carlsson

Incorrect authorization in the BackgroundFetch component allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from one origin can interact with a resource from another origin, by using a crafted HTML page.

An Improper Neutralization of Input During Web Page Generation issue exists in GitHub Enterprise Server. This allows an attacker to render attacker-controlled HTML via the Filter component (search) across GitHub, potentially leading to the exfiltration of sensitive information. An attacker requires permissions to create or modify the names of milestones, issues, pull requests, or similar entities rendered in the vulnerable filter/search components to exploit this issue.

Name of the Vulnerable Software and Affected Versions: Bootstrap versions 3.4.1 through 3.4.x Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows attackers to run malicious scripts. A DOM-based XSS flaw was found in Bootstrap 3 Tooltips & Popovers, which can be exploited via DOM clobbering, putting outdated applications at risk. Recommendations: For Bootstrap versions 3.4.1 through 3.4.x, update to version 4.0.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of Bootstrap 3 Tooltips & Popovers until a patch is available. Restrict access to potentially vulnerable web pages to minimize the risk of exploitation.

A Code Injection vulnerability was identified in GitHub Enterprise Server that allowed attackers to inject malicious code into the query selector via the `identity` property in the message handling function. This enabled the exfiltration of sensitive data by manipulating the DOM, including authentication tokens. To execute the attack, the victim must be logged into GitHub and interact with the attacker-controlled malicious webpage containing the hidden iframe. This vulnerability occurs due to an improper sequence of validation, where the origin check occurs after accepting the user-controlled `identity` property.

A privacy issue was addressed with improved handling of files. Copying a URL from Web Inspector may lead to command injection. The issue is related to the Web Inspector tool in iOS, iPadOS, macOS, and Safari, which is associated with a lack of data sanitization at the management level. This may allow a remote attacker to execute arbitrary commands.

Processing maliciously crafted web content may lead to a cross site scripting attack.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to the ALSA: usb-audio component in the Linux kernel. It occurs when a USB audio device sets more bits than the amount of channels, potentially allowing writing outside of the map array. This could lead to arbitrary code execution. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A logic issue was addressed with improved validation. Processing maliciously crafted web content may prevent Content Security Policy from being enforced. The issue is related to insufficient input validation in WebKitGTK and WPE WebKit modules, which may allow a remote attacker to access and compromise confidential data.

The issue is related to the incorrect honoring of Set-Cookie response headers in multipart HTTP responses. If an attacker can control the Content-Type response header and part of the response body, they can inject Set-Cookie response headers that would be honored by the browser. This allows a remote attacker to inject arbitrary HTTP headers, such as Set-Cookie.

The issue is related to Cross-site Scripting in the tag name pattern field in the tag protections UI. This allows a malicious website, requiring user interaction and social engineering, to make changes to a user account via CSP bypass with created CSRF tokens. The vulnerability was reported via the GitHub Bug Bounty program.

The issue is related to the WebKit module in Safari and various operating systems, including watchOS, tvOS, iPadOS, iOS, and macOS. It is caused by a lack of protection for the web page structure, which may allow a remote attacker to conduct a cross-site scripting (XSS) attack. Processing a document can lead to this type of attack.

The issue is related to errors in handling input data during code syntax analysis, which may allow a remote attacker to execute arbitrary javascript code. This can be achieved through the exploitation of vulnerabilities in the WebKitGTK and WPE WebKit modules, used for displaying web pages.

The issue is related to an inappropriate implementation in the iFrame Sandbox of Google Chrome, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This can enable the attacker to bypass existing security restrictions and gain unauthorized access to protected information.

The issue is related to insufficient access control in the handling of iframe elements by Mozilla Firefox and Mozilla Thunderbird. An attacker could exploit this by creating a sandboxed iframe without the `allow-scripts` permission and then appending an element with a JavaScript event handler to the iframe's document, allowing the event handler to run despite the sandbox restrictions.