Flash cross-domain policy
Summary: The Flash cross-domain policy controls whether Flash client components on other domains can perform two-way interaction with the domain that publishes the policy. If an allowed domain is compromised or malicious, content running there can gain full access to the application within the security context of a logged-in user.
What's compelling: Every domain listed in the policy is a domain you are trusting with the security posture of your logged-in users, and a vulnerability in any one of them can be leveraged by a third party to attack your application.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026