439 matches found
CVE-2019-17581
tonyy dormsystem through 1.3 allows DOM XSS...
Cross site scripting
tonyy dormsystem through 1.3 allows DOM XSS...
CVE-2019-17581
tonyy dormsystem through 1.3 allows DOM XSS...
Razer: DOM XSS at https://www.thx.com in IE/Edge browser
Summary: I just recently found easy exploitable DOM XSS vulnerability because of https://www.thx.com/assets/plugins/ultimate-social-media-icons/js/custom.js?ver=5.2.3 js file Steps To Reproduce: First i want to say this is vulnerable code function sfsimobilewechatshareurl if...
Escalation of Privilege in Twistlock
An HTML injection vulnerability has been identified in the Twistlock Console that can lead to a DOM based XSS attack under certain configurations. Ref , CVE-2019-1583 Successful exploitation of this vulnerability allows a Twistlock user with Operator capabilities to escalate privileges to that of...
CVE-2015-9299
The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS...
Cross site scripting
The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS...
CVE-2015-9299
The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS...
Ovidentia 8.4.3 - Cross-Site Scripting
Ovidentia 8.4.3 - Cross-Site Scripting ------------------------------------------------------- Exploit Title: Ovidentia CMS - XSS Ovidentia 8.4.3 Description: The vulnerability permits any kind of XSS attacks. Reflected, DOM and Stored XSS. Date: 06/05/2019 CVE: CVE-2019-13977 Exploit Author:...
Ovidentia 8.4.3 - Cross-Site Scripting
------------------------------------------------------- Exploit Title: Ovidentia CMS - XSS Ovidentia 8.4.3 Description: The vulnerability permits any kind of XSS attacks. Reflected, DOM and Stored XSS. Date: 06/05/2019 CVE: CVE-2019-13977 Exploit Author: Fernando Pinheiro n3k00n3 Victor Flores...
Ovidentia 8.4.3 Cross Site Scripting
------------------------------------------------------- Exploit Title: Ovidentia CMS - XSS Ovidentia 8.4.3 Description: The vulnerability permits any kind of XSS attacks. Reflected, DOM and Stored XSS. Date: 06/05/2019 CVE: CVE-2019-13977 Exploit Author: Fernando Pinheiro n3k00n3 Victor Flores...
Shopify: ██████ DOM XSS via Shopify.API.remoteRedirect
Hi, team. I found a dom xss on the apple-business-chat app that seems to be referring to a vulnerable js file. For users who have installed this app, just let him use the theme code I provided to complete xss. Modify the theme code to the following payload function attack let...
Shopify: DOM XSS via Shopify.API.Modal.initialize
Similar 422043 & 576532 Payload Based on 576532: html function attack const ctx = window.openlocation.origin+'/admin/themes', 'blank' const json = message: "Shopify.API.Modal.initialize", data: src: "" let interval; interval = setIntervalfunction if window.attackSuccess clearIntervalinterval else...
Cross site scripting
Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element...
CVE-2018-19048
Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element...
CVE-2018-19048
Simditor up to version 2.3.21 is affected by a DOM XSS (attackable via an onload attribute in a malformed SVG element). The underlying issue is improper handling/sanitization of SVG onload events, enabling injection of arbitrary JavaScript in the user’s browser. Mitigation: upgrade to version 2.3...
CVE-2018-19048
Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element...
Shopify: DOM XSS via Shopify.API.remoteRedirect
hi, team, after I read the report 422043, I found another monitor postmessage, and did not correctly verify the origin, leading to dom xss, using the store theme can write js this feature, we can modify a theme for the following Payload, function attack var...
QIWI: DOM XSS triggered in secure support desk
Summary Due to insufficient input sanitization, an attacker can send a crafted WebSocket message that will result in arbitrary code execution in the chat support backend, giving an attacker control to support tickets and client information. Technical details The vulnerability exists in line 2544 ...
