CVE-2020-9055

Versiant LYNX CSP 3.5.2 is vulnerable to stored cross-site scripting due to insufficient input validation, enabling a local, authenticated attacker to inject JavaScript that is stored and executed for end users (possible redirects, session cookie hijacking, information disclosure). The issue is d...

CVE-2020-9055: Improper Neutralization of Input During Web Page Generation

Versiant LYNX Customer Service Portal CSP, version 3.5.2, is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to insert malicious JavaScript that is stored and displayed to the end user. This could lead to website redirects, session cookie hijacking, or...

CVE-2019-15539

The projdoceditpage.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting XSS vulnerability, allowing execution of arbitrary code if CSP settings permit it after uploading an attachment with a crafted filename. The code is executed when editing the document...

CVE-2019-15539

The CVE-2019-15539 entry concerns MantisBT before version 2.21.3, affecting the proj_doc_edit_page.php Project Documentation feature. The vulnerability is a stored XSS flaw triggered when uploading an attachment with a crafted filename; the injected script is executed when editing the document pa...

PT-2020-19241

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 74 Description The issue allows an attacker to inject arbitrary styles into a CSS block by exploiting the @import statement, bypassing the intent of the Content Security Policy when protecting CSS blocks with the nonc...

GitLab: Stored XSS in blob viewer

Summary I found a Stored-XSS in blob viewer when viewing a json file. In particular, when viewing an openapi file, openapiviewer is called to transfer the file's data to SwaggerUIBundle to render. SwaggerUIBundle does its job when rending graphical representation of the openapi's content. It also...

PayPal: Reflect XSS and CSP Bypass on https://www.paypal.com/businesswallet/currencyConverter/

An endpoint used for currency conversion was found to suffer from a reflected XSS vulnerability, where user input was not being properly sanitized in a parameter in the URL. This could lead to a malicious user injecting malicious JavaScript, HTML, or any other type of code that the browser may...

chromium-browser: Insufficient policy enforcement in CSP

Insufficient policy enforcement in CSP in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML page...

CVE-2020-6391

CVE-2020-6391 concerns Blink in Google Chrome. The vulnerability arises from insufficient validation of untrusted input in Blink, allowing a local attacker to bypass Content Security Policy via a specially crafted HTML page on Chrome versions prior to 80.0.3987.87. Affected product: Google Chrome...

Clario: Multiple Links Vulnerable to Reflected xss

Summary Multiple Links Vulnerable to Reflected xss in https://mackeeper.com/mk/de/ Steps to reproduce goto these links and xss will be triggered...

PT-2020-19156

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 80.0.3987.87 Description The issue is related to insufficient policy enforcement in the Content Security Policy CSP of Google Chrome, allowing a remote attacker to bypass the content security policy. This can be...

KLA11660 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, obtain sensitive information, cause denial of service, spoof user interface. Below is a complete list of vulnerabilities: 1. A...

USN-4234-2 firefox regressions

USN-4234-1 fixed vulnerabilities in Firefox. The update introduced various minor regressions. This update fixes the problems. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafte...

h1-ctf: [h1-415 2020] Chain of vulnerabilities leading to account takeover and unauthorized access of sensitive internal resources

Note: Please read this report as "An attacker taking over a customer's account" and not as "helping Jobert recovering his document" : Summary: Chaining following issues let's an attacker access sensitive information, 1. Exposure of customer email and regex logic error leading to account takeover ...

Directive injection when using dynamic overrides with user input in RubyGems secure_headers

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be us...

GHSA-XQ52-RV6W-397C Directive injection when using dynamic overrides with user input

Impact If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in...

h1-ctf: [h1-415 2020] @_bayotop h1-415-ctf writeup

TL;DR: Thanks for the challenge! 1. Abusing account recovery via QR codes to get access to [email protected]. 2. Blind XSS in /support/review/ including CSP bypass. 3. Missing input sanitization on name parameter when POSTing to /support/review/. 4. Access to remote debugging port on local...

h1-ctf: [h1-415 2020] My writeup on how to retrieve the special secret document

Summary: An attacker without any privilege is able to retrieve the special secret document, hosted on the https://h1-415.h1ctf.com website. To do so, multiple steps are required : 1. The authentication must be bypassed to have a licensed account; 2. The support team portal is vulnerable to a blin...

CVE-2019-17001

CVE-2019-17001 describes a CSP bypass in Firefox where an object tag can bypass the page's CSP to execute JavaScript in the protected document. The issue affected Firefox 69 and was not present in earlier versions; it affects Firefox

CVE-2019-17002

CVE-2019-17002 affects Mozilla Firefox versions before 70.0. If upgrade-insecure-requests is set in the Content Security Policy and a link is dragged and dropped from that page, the link is not upgraded to https, exposing users to potential security bypass and stability issues. The primary impact...