地图 / risk of having secure=false in a crossdomain.xml

risk of having secure=false in a crossdomain.xml

内存破坏 / 内存破坏（通用） / #105463

厂商: Imgur
严重程度: 未评级
赏金: —
弱点: 内存破坏（通用）
研究员: @hacker00000000
披露日期: 2016-03-03
资产: —
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（959 字符中的一小部分）

api.imgur.com permits SWF files on a non-HTTPS server to load data from this HTTPS server. Setting the secure attribute to false could compromise the security offered by HTTPS. In particular, setting this attribute to false opens secure content to snooping and spoofing attacks.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Imgur 所有。

时间线

2015-12-15报告提交
2016-03-03公开披露

阅读 HackerOne 原文 ↗作者 @hacker00000000 · 版权归作者与 Imgur 所有

同类报告

Race Conditions in Popular reports feature.HackerOne · 2016-08-03 Malformed .MDL triggers an Access Violation on GoldSRC (hl.exe)Valve · 2019-10-09 [FG-VD-19-009] Intel(R) Trace Analyzer and Collector 2019 Memory Corruption Vulnerability NotificationIntel Corporation · — · $1,500 Type Confusion Vulnerability - SOAP / make_http_soap_request()Internet Bug Bounty · 2019-10-15 · $1,000 Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string.Node.js · 2025-05-15 Heap overflow in mysqlnd related to BIT fields (CVE-2016-7412)Internet Bug Bounty · 2019-11-12

risk of having secure=false in a crossdomain.xml · 破甲 POJIA