Krzysztof Kotowicz

The HTTP referrer header may be used to leak browsing history when visiting a maliciously crafted website, potentially revealing the sites a user has visited.

The issue allows cross-site scripting due to the regex-based input HTML replacement potentially turning sanitized code into unsanitized code. This can occur when `<option>` elements are wrapped in `<select>` elements, changing the parsing behavior and possibly leading to unsanitized code.

Name of the Vulnerable Software and Affected Versions: EasyXDM versions prior to 2.4.18 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the easyxdm.swf file, which is a form of Cross-site Scripting (XSS). Recommendations: For versions prior to 2.4.18, update to version 2.4.18 or later to resolve the issue.

The issue concerns the QuickType feature in the Keyboards subsystem, which collects typing-prediction data from fields even when the autocomplete attribute is set to off. This behavior potentially allows attackers to discover credentials by reading credential values within unintended DOM input elements.

The issue allows man-in-the-middle attackers to bypass server certificate validation, redirect a connection, and obtain sensitive information via crafted responses, due to the client supporting anonymous ciphers by default.

The issue allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via a crafted string in a response. This triggers a downgrade to simple authentication, which sends credentials in plaintext.

The SSL protocol 3.0 uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, also known as the "POODLE" issue. This allows an attacker to decrypt some encrypted contents under certain conditions. The conditions of successful exploitation are somewhat similar to the BEAST attack, which requires several conditions to be met for successful exploitation, including a man-in-the-middle position in the network and the ability to direct the victim client to send many repeated requests to the vulnerable server on behalf of the attacker. Due to the conditions required of a successful attack scenario, the risk of exploitation is not particularly high.