CVE-2017-18016

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine (reusing the current website's token, which is not bound to an origin).

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-346

Affected software

No affected versions have been published.

Timeline

Published
Jan 11, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-180179.8The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attacCVE-2017-180187.1In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of theCVE-2017-180197.1In K7 Total Security before 15.1.0.305, user-controlled input to the K7Sentry device is not sufficiently sanitized: the user-controlled inpuCVE-2017-180208.4On Samsung mobile devices with L(5.x), M(6.x), and N(7.x) software and Exynos chipsets, attackers can execute arbitrary code in the bootloadCVE-2017-180219.8It was discovered that QtPass before 1.2.1, when using the built-in password generator, generates possibly predictable and enumerable passwoCVE-2017-180226.5In ImageMagick 7.0.7-12 Q16, there are memory leaks in MontageImageCommand in MagickWand/montage.c.CVE-2017-180236.1Office Tracker 11.2.5 has XSS via the logincount parameter to the /otweb/OTPClientLogin URI.CVE-2017-180246.1AvantFAX 3.3.3 has XSS via an arbitrary parameter name to the default URI, as demonstrated by a parameter whose name contains a SCRIPT elemeCVE-2017-180259.8cgi-bin/drknow.cgi in Innotube ITGuard-Manager 0.0.0.1 allows remote attackers to execute arbitrary OS commands via shell metacharacters in CVE-2017-180268.8Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg prograCVE-2017-180276.5In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allow remote attackersCVE-2017-180286.5In ImageMagick 7.0.7-1 Q16, a memory exhaustion vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allow remote a