Skip to content

Latest commit

 

History

History
118 lines (99 loc) · 25 KB

uxssDB.md

File metadata and controls

118 lines (99 loc) · 25 KB
Raw

UXSS recorded vulnerabilities

This file contains the list of CVE vulnerabilities that we studied during the term project.

Chrome:

Browser:

Extension based vulnerabilities

  • CVE-2011-2107: http://www.adobe.com/support/security/bulletins/apsb11-13.html -- Flash Player Flaw. This was an important vulnerability that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, when victim visits malicious website.
  • CVE-2017-5020: https://bugs.chromium.org/p/chromium/issues/detail?id=668653&desc=2 -- chrome://downloads vulnerability that allows a malicious extension to run a program without user interaction: When the victim installs or upgrades a malicious extension, the XSS is perform on chrome://downloads by setting the extension name in the innerHTML assignment. This with the bypassing of CSP and safe browsing, will allow when the user click to run a program outside of chrome, the extension to run arbitrary code NS

Safari

Edge/IE

Browser

Extension based vulnerabilities

Mozilla Firefox

Opera

  • CVE-2013-4705: https://www.cvedetails.com/cve/CVE-2013-4705/ -- Cross-site scripting (XSS) vulnerability in Opera before 15.00 allows remote attackers to inject arbitrary web script or HTML by leveraging UTF-8 encoding.
  • CVE-2012-6464: http://www.opera.com/fr/security/advisory/1032 -- Cross domain access to object constructors can be used to facilitate cross-site scripting -- JavaScripts are able to redefine and override the methods of native objects. They may also do this with the native objects of any document that shares the same origin. By redefining the methods of another document through the constructor property of the document's host objects, a malicious script can cause Opera to override methods of native objects in documents from different origins. When scripts in those target documents then access those methods, they run the scripts defined by the malicious document, in the context of the target site. This allows cross-site scripting (XSS) attacks.
  • CVE-2012-6463: http://www.opera.com/fr/security/advisory/1031 -- Data URIs can be used to facilitate Cross-Site Scripting. Data URIs are only supposed to inherit the scripting origin from the site that creates them, such as by including them as the target of a link or an inline frame in the source of the document. Specific sequences of document and data URI loading can cause Opera to forget which document created the data URI, and to allow the data URI document to inherit the scripting origin of a target page instead. The data URI document would then be allowed to interact with the target page, instead of the document that created it, resulting in cross-site scripting (XSS).
  • CVE-2012-4144: http://www.opera.com/fr/security/advisory/1025 -- Element HTML content can be incorrectly returned without escaping, bypassing some HTML sanitizers -- When sites accept HTML from untrusted users, and use that HTML as page content, they typically sanitize the untrusted HTML to ensure that it does not contain any harmful content, such as malicious scripts. In some cases, this sanitization may be performed by writing and reading the contents of DOM elements. In certain situations, Opera may return the HTML contents of an element without correctly escaping all of the characters that denote HTML markup, allowing them to fool the sanitizer, so that they are subsequently interpreted as markup after being inserted into the page. This can then be used to facilitate cross-site scripting (XSS) attacks against Opera, without being detected by a sanitizer.
  • CVE-2012-4142: http://www.opera.com/fr/security/advisory/1026 -- Certain characters in HTML can incorrectly be ignored, which can facilitate XSS attacks -- Sites that allow content to be provided by untrusted users, such as forums and blogging sites, typically sanitize the untrusted content to ensure that it does not contain any harmful content, such as malicious scripts. When certain characters appear at specific locations within HTML markup, they can cause Opera to ignore either that character, or the one following it, potentially altering the interpretation of the following markup. This can be used to facilitate cross-site scripting (XSS) attacks against Opera, without being detected by a sanitizer.
  • CVE-2012-3556: http://www.opera.com/fr/security/advisory/1020 -- A combination of clicks and key presses can lead to cross site scripting or code execution -- Some sort of clickjacking: When a user double clicks on a page, they may expect the two clicks to target the same object. If a page uses the first click to open a pop-up window in a predictable location, the second click may focus parts of the new window, such as its address field. If the page can then convince the user to activate a scripted URL seeded in the address field, on a newly loaded target page within the pop-up, it can allow cross site scripting against the target page. Similar attacks could also be used against Opera's preferences to change preferences or select executables to be run by Opera. Non-trivial social engineering would be required to ensure that the user followed the desired sequence of clicks and keypresses, at precisely the right speed, while ignoring the opening and loading of pages within the pop-up.
  • CVE-2012-3555: http://www.opera.com/fr/security/advisory/1021 -- Hidden keyboard navigation can allow cross site scripting or code execution. Some sort of clickjacking: When a user is interacting with a window, that window should be visible to the user, to ensure that the user realizes it is there. If a page is displayed in a small enough window, the user may not realize it is being displayed, and if the right keyboard sequence is carefully followed, they can end up performing undesirable actions on that page. Similar attacks could also be used against Opera's preferences to change preferences or select executables to be run by Opera. Additional social engineering steps are needed to ensure that the user presses the correct key sequence, without being able to show any relevant visual feedback, as the page cannot see that the keys are being pressed.
  • CVE-2011-2609: http://www.opera.com/fr/security/advisory/995 -- Data URIs may be used to initiate cross site scripting against unrelated sites. Data URIs are supposed to inherit the security context from the page that created them. In some cases, Opera does not enforce this correctly, and will allow unrelated data URIs to interact both with each other, and their source pages. This can be used to enable cross site scripting against the target site, if the target site has some appropriate markup that allows it to be targeted.
  • CVE-2010-4047: http://www.opera.com/fr/security/advisory/976 -- JavaScript might run in the wrong context if loaded from error page. If Opera is sent to an invalid URL, an error page will be displayed along with a link to the URL. The URL linked to might run scripts, and in some cases these scripts might be run in the wrong security context. This can be used to execute scripts in the context of an unrelated domain, which allows cross-site scripting. To exploit this vulnerability, an attacker must get the user to interact with a specially crafted error page.
  • CVE-2010-4045: http://www.opera.com/fr/security/advisory/973 -- Reloads and redirects can allow spoofing and cross site scripting. Scripts on a page are supposed to be restricted so that they can only interact with other pages from the same domain and security context. Carefully timed reloads and redirects, when combined with appropriate caching, can cause scripts to execute in the wrong security context in Opera. This allows cross site scripting (XSS). In some cases, the address bar will also show the address of the target page. With minimal user interaction, this particular XSS vector may also be used to modify Opera's configuration, and this may in turn be used to execute arbitrary code on the computer.
  • CVE-2010-2665: http://www.opera.com/fr/security/advisory/955 -- Data URIs can be used to allow cross-site scripting. Data URIs are allowed to run scripts that manipulate pages from the site that directly opened them. In some cases, the opening site is not correctly detected. In these cases, Data URIs may erroneously be able to run scripts so that they interact with sites that did not directly cause them to be opened.
  • CVE-2009-4071: http://www.opera.com/fr/security/advisory/941 -- Error messages can leak onto unrelated sites. Scripting error messages are normally available only to the page that caused the error. In some cases, the error messages could be passed to other sites as the contents of unrelated variables, and may contain sensitive information. If those sites write the content into the page markup, this could allow cross-site scripting, using code provided by the attacking site. This issue only affects installations that have enabled stacktraces for exceptions, these are disabled by default.
  • CVE-2009-3266: http://www.opera.com/fr/security/advisory/939 -- Opera may allow scripts to access feeds. Opera may allow scripts to run on the feed subscription page, thereby gaining access to the feeds object. This can be used for automatic subscription of feeds, or reading other feeds.
  • CVE-2009-3013: http://websecurity.com.ua/3386/ -- Cross-Site Scripting attacks via redirectors. XSS attack via refresh-header redirectors. Attack is doing by redirecting to javascript: URI.
  • CVE-2008-5682: http://www.opera.com/fr/security/advisory/924 -- Built-in XSLT templates can allow cross-site scripting. Built-in XSLT templates incorrectly handle escaped content and can cause it to be treated as markup. If a site accepts content from untrusted users, which it then displays using XSLT as escaped strings, this can allow scripted markup to be injected. The scripts will then be executed in the security context of that site. NOTE: XSL (eXtensible Stylesheet Language) is a styling language for XML.
  • CVE-2008-1082: https://www.cvedetails.com/cve/CVE-2008-1082/ -- "bypass sanitization filters" and conduct cross-site scripting (XSS) attacks via crafted attribute values in an XML document, which are not properly handled during DOM presentation.