CVE-2019-9737

Editor.md 1.5.0 has DOM-based XSS via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...

CVE-2019-9738

jimmykuu Gopher 2.0 has DOM-based XSS via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...

CVE-2019-9736

DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...

Default credentials

jimmykuu Gopher 2.0 has DOM-based XSS via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...

CVE-2019-9737

Editor.md 1.5.0 has DOM-based XSS via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...

CVE-2019-9736

CVE-2019-9736 affects 1024Tools Markdown 1.0 with a DOM-based XSS vulnerability triggered by embedding an SVG data URL via the substring ‘<EMBED SRC="data:image/svg+xml'’. The NVD entries cite CVSS2/3 base scores of 4.3 (MEDIUM) and 6.1 (MEDIUM), respectively; attack vector is NETWORK (CVSS2) ...

CVE-2019-9738

CVE-2019-9738 affects jimmykuu Gopher 2.0 and is a DOM-based XSS triggered via an embedded SVG payload in an EMBED SRC="data:image/svg+xml" string. Root cause: DOM-based XSS in the client-side handling of embeds. Impact is described by CVSS metrics in the sources: CVSS v2 base score 4.3 (Network,...

CVE-2019-9736

DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...

CVE-2019-9737

Summary: CVE-2019-9737 affects Editor.md 1.5.0 with a DOM-based XSS vulnerability triggered by vectors including the substring <EMBED SRC="data:image/svg+xml.** The root cause is persistent insufficient sanitization of user input that can introduce base64-encoded content, enabling script execu...

CVE-2019-9738

jimmykuu Gopher 2.0 has DOM-based XSS via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...

Rockstar Games: DOM based XSS on /GTAOnline/tw/starterpack/

In this report the researcher identified a DOM-based XSS vulnerability impacting localized versions of the https://www.rockstargames.com/GTAOnline/ site in varying locations. This attack also took advantage of an Open Redirect vulnerability on another part of the site to demonstrate how an attack...

Rockstar Games: DOM based XSS on /GTAOnline/de/news/article via "returnUrl" parameter

In this report, the researcher identified a DOM-based cross-site scripting vulnerability affecting localized versions of the GTA Online screenshots site, e.g. https://www.rockstargames.com/GTAOnline/jp/screens/. We have pushed out an update fixing this vulnerability so that it is no longer...

Mail.ru: Seven DOM-Based XSS Vulnerabilities | Execution in Login Sequence

DOM based XSS in tz.mail.ru tz.mail.ru belongs to extended scope I was able to exploit DOM XSS at the following endpoints. The vulnerability was exploitable on forbidden pages and the root cause lies in jquery. text https://tz.mail.ru/a/ https://tz.mail.ru/a/js/ https://tz.mail.ru/www/...

HackerOne: DOM Based XSS in www.hackerone.com via PostMessage (bypass of #398054)

Summary The security fix by Marketo to resolve the issue reported by @adac95 in 398054 can be bypassed by purchasing an .ma domain for €60. Description The issues described by @adac95 in 398054 remain insufficiently resolved because of an inadequate security check by Marketo in the following piec...

Rockstar Games: Dom based xss on /reddeadredemption2/br/videos

In this report, the researcher identified a DOM-based XSS vulnerability affecting localized versions of the Red Dead Redemption 2 video viewer on our website, e.g. www.rockstargames.com/reddeadredemption2/br/videos. This affected all major modern browsers, and could have been used for cookie or...

Rockstar Games: DOM BASED XSS ON https://www.rockstargames.com/GTAOnline/features

In this report, the researcher identified a DOM-based Cross-Site Scripting vulnerability under the GTAOnline section of the main site. This could have left to theft of cookies if left unresolved. Interestingly, a core factor in this vulnerability was a regression of a previously identified and...

CVE-2018-6076

Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack via a crafted HTML page...

CVE-2018-6076

Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack via a crafted HTML page...

Design/Logic Flaw

Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack via a crafted HTML page...

CVE-2018-6076

CVE-2018-6076 affects Google Chrome (Blink) where URL fragment identifiers were not encoded correctly, enabling a remote attacker to trigger a DOM-based XSS via a crafted HTML page. Concrete details in connected records place the vulnerable component in Blink/Chrome prior to version 65.0.3325.146...