Vulnerability hunting with Semmle QL: DOM XSS

In two previous blog posts part 1 and part 2, we talked about using Semmle QL in C and C++ codebases to find vulnerabilities such as integer overflow, path traversal, and those leading to memory corruption. In this post, we will explore applying Semmle QL to web security by hunting for one of­­­...

Serendipity Package Cross-Site Scripting Vulnerability

Serendipity is a PHP-based blogging system from the Serendipity team. The system supports the creation of online journals, blogs, web pages and more. A cross-site scripting vulnerability exists in Xinha in Serendipity packages prior to version 1.5.5. The vulnerability stems from a lack of proper...

Forcepoint Email Security Cross-Site Scripting Vulnerability

Forcepoint Email Security is a suite of email protection solutions from US-based Forcepoint. The product includes features such as spam filtering, malware detection, phishing protection, and protection against intrusion BEC attacks. A cross-site scripting vulnerability exists in Forcepoint Email...

Smartwares HOME easy 1.0.9 - Client-Side Authentication Bypass

Smartwares HOME easy 1.0.9 - Client-Side Authentication Bypass Exploit Title: Smartwares HOME easy 1.0.9 - Client-Side Authentication Bypass Author: LiquidWorm Date: 2019-11-05 Vendor: Smartwares Product web page: https://www.smartwares.eu Affected version: =1.0.9 Advisory ID: ZSL-2019-5540...

Smartwares HOME easy 1.0.9 - Client-Side Authentication Bypass

Exploit Title: Smartwares HOME easy 1.0.9 - Client-Side Authentication Bypass Author: LiquidWorm Date: 2019-11-05 Vendor: Smartwares Product web page: https://www.smartwares.eu Affected version: =1.0.9 Advisory ID: ZSL-2019-5540 Advisory URL:...

Smartwares HOME Easy 1.0.9 Authentication Bypass

Smartwares HOME easy v1.0.9 Client-Side Authentication Bypass Vendor: Smartwares Product web page: https://www.smartwares.eu Affected version: =1.0.9 Summary: Home Easy/Smartwares are a range of products designed to remotely control your home using wireless technology. Home Easy/Smartwares is ver...

Smartwares HOME easy 1.0.9 - Client-Side Authentication Bypass Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Smartwares HOME easy 1.0.9 - Client-Side Authentication Bypass Author: LiquidWorm Vendor: Smartwares Product web page: https://www.smartwares.eu Affected version: =1.0.9 Advisory ID: ZSL-2019-5540 Advisory URL:...

TYPO3 cross-site scripting vulnerability (CNVD-2019-40299)

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A cross-site scripting vulnerability exists in Extension Manager in TYPO3. The vulnerability stems from the lack of proper validation of client-side data in the WEB application, which can b...

Online Store System Cross-Site Scripting Vulnerability

Online Store System is an e-commerce system. A cross-site scripting vulnerability exists in Online Store System v1.0. The vulnerability stems from a lack of proper validation of client-side data in the web application. An attacker can exploit this vulnerability to execute client-side code...

Smartwares HOME easy v1.0.9 Client-Side Authentication Bypass

Summary Home Easy/Smartwares are a range of products designed to remotely control your home using wireless technology. Home Easy/Smartwares is very simple to set up and allows you to operate your electrical equipment like lighting, appliances, heating etc. Description HOME easy suffers from...

Online Store System Cross-Site Scripting Vulnerability (CNVD-2019-40112)

Online Store System is an e-commerce system. A cross-site scripting vulnerability exists in Online Store System v1.0. The vulnerability stems from a lack of proper validation of client-side data in the web application. An attacker can exploit this vulnerability to execute client-side code...

XunRuiCMS Cross-Site Scripting Vulnerability

XunRuiCloud Software Development XunRuiCMS XunRuiCMS is an open source content management system CMS from China XunRuiCloud Software Development Company. A cross-site scripting vulnerability exists in XunRuiCMS version 4.3.1. The vulnerability stems from the lack of proper validation of client-si...

AVG AntiVirus Cross-Site Scripting Vulnerability (CNVD-2020-10164)

Avast Antivirus is a suite of antivirus software from the Czech company Avast. A cross-site scripting vulnerability exists in Network Notification Popup in Avast AntiVirus Free, Internet Security and Premiere Edition version 19.3.2369 build 19.3.4241.440. The vulnerability stems from a lack of...

Websieve Cross-Site Scripting Vulnerability

websieve is a web-based email server management program. A cross-site scripting vulnerability exists in websieve version v0.62, which stems from the lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute client-side code...

F5 BIG-IP cross-site scripting vulnerability (CNVD-2019-39753)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A cross-site scripting vulnerability exists in F5 BIG-IP versions 13.1.0 through 13.1.3, 12.1.0 through 12.1.5, and 11.5.2...

WordPress weeklynews theme cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. weeklynews theme is a news site theme plugin used in it. WordPress weeklynews theme suffers from a cross-site scripting vulnerability...

WordPress Easy Digital Downloads Recount Earnings extension cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Easy Digital Downloads EDD Recount Earnings extension is a sales statistics plugin used in it. A cross-site scripting vulnerability...

Amazon Linux 2 : httpd (ALAS-2019-1341)

A cross-site scripting vulnerability was found in Apache httpd, affecting the modproxy error page. Under certain circumstances, a crafted link could inject content into the HTML displayed in the error page, potentially leading to client-side exploitation.CVE-2019-10092 A vulnerability was...

WordPress Auberge theme cross-site scripting vulnerability

WordPress is a blogging platform from the WordPress Foundation developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.Auberge theme is a responsive restaurant website theme plugin used in it. WordPress Auberge theme suffers from a cross-sit...

WordPress Modern theme cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Modern theme is a multi-functional website theme plugin used in it. A cross-site scripting vulnerability exists in WordPress Modern...