CVE

Id
36629  
CVE No.
CVE-2008-6512  
Status
Candidate  
Description
Cross-domain vulnerability in the WorkerPool API in Google Gears before 0.5.4.2 allows remote attackers to bypass the Same Origin Policy and the intended access restrictions of the allowCrossOrigin function by hosting an assumed-safe file type containing Google Gear commands on the target domain, then accessing that file from the attacking domain, whose response headers are not checked and cause the worker code to run in the target domain.  
Phase
Assigned (20090324)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
399566 36629 CVE-2008-6512 FULLDISC:20081208 Breaking Google Gears" Cross-Origin Communication Model  View
399567 36629 CVE-2008-6512 URL:http://lists.grok.org.uk/pipermail/full-disclosure/2008-December/066291.html  View
399568 36629 CVE-2008-6512 MISC:http://blog.watchfire.com/wfblog/2008/12/breaking-google-gears-cross-origin-communication-model.html  View
399569 36629 CVE-2008-6512 CONFIRM:http://code.google.com/apis/gears/upcoming/api_workerpool.html#cross_origin  View
399570 36629 CVE-2008-6512 BID:32698  View
399571 36629 CVE-2008-6512 URL:http://www.securityfocus.com/bid/32698  View
399572 36629 CVE-2008-6512 SECUNIA:33062  View
399573 36629 CVE-2008-6512 URL:http://secunia.com/advisories/33062  View
399574 36629 CVE-2008-6512 XF:gears-allowcrossorigin-security-bypass(47173)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
44493 JVNDB-2009-005500 phpKF-Portal におけるディレクトリトラバーサルの脆弱性 phpKF-Portal には、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2008-6516 36629 7.5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-005500.html  View