CVE-2017-18016

Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine (reusing the current website's token, which is not bound to an origin).

• CWE-346

• http://www.openwall.com/lists/oss-security/2018/01/10/1Exploit, Mailing List, Third Party Advisory
• https://github.com/paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215Patch, Third Party Advisory
• https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016Exploit, Technical Description, Third Party Advisory
• https://www.exploit-db.com/exploits/43499/Exploit, Third Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2018/01/10/1Exploit, Mailing List, Third Party Advisory
• https://github.com/paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215Patch, Third Party Advisory
• https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016Exploit, Technical Description, Third Party Advisory
• https://www.exploit-db.com/exploits/43499/Exploit, Third Party Advisory, VDB Entry

Published

Jan 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-18010The E-goi Smart Marketing SMS and Newsletters Forms plugin b…
• CVE-2017-18011The MyCBGenie Affiliate Ads for Clickbank Products plugin th…
• CVE-2017-18012The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the…
• CVE-2017-18013In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the…
• CVE-2017-18014An NC-25986 issue was discovered in the Logging subsystem of…
• CVE-2017-18015The ILLID Share This Image plugin before 1.04 for WordPress …
• CVE-2017-18017The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS…9.8
• CVE-2017-18018In GNU Coreutils through 8.29, chown-core.c in chown and chg…7.1
• CVE-2017-18019In K7 Total Security before 15.1.0.305, user-controlled inpu…
• CVE-2017-18020On Samsung mobile devices with L(5.x), M(6.x), and N(7.x) so…
• CVE-2017-18021It was discovered that QtPass before 1.2.1, when using the b…
• CVE-2017-18022In ImageMagick 7.0.7-12 Q16, there are memory leaks in Monta…