Yosuke Hasegawa

The issue is related to insufficient access restrictions in Internet Explorer, allowing a remote attacker to bypass existing access restriction policies. This can be exploited to bypass the Same Origin Policy via unspecified vectors.

An information disclosure issue exists, allowing remote attackers to perform cross-domain reading of JSON files via a crafted web site. This could enable an attacker to gain access and read the contents of JSON data files.

The issue allows remote attackers to read content from a different domain or zone via a crafted web site. An information disclosure vulnerability exists that could allow an attacker to force the browser to perform unexpected actions when a user downloads Web content, allowing an attacker to view content from a different domain or Internet Explorer zone other than the domain or zone of the attacker's Web page.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a crafted feed.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via unspecified vectors, potentially leading to the execution of malicious code on the client-side.

The issue allows remote attackers to access content from a different domain or zone via unspecified script code. An information disclosure vulnerability exists that could allow script to gain access to information in another domain or Internet Explorer zone. An attacker could exploit the vulnerability by constructing a specially crafted Web page that could allow information disclosure if a user viewed the Web page, potentially viewing content from another domain or Internet Explorer zone.

The issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted HTML document, due to the importScripts Web Worker method not verifying that content is valid JavaScript code.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the HTML filter. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. This can be achieved via the data: URI in an HTML e-mail attachment or through various non-ASCII character sets that are not properly filtered when viewed with Microsoft Internet Explorer.