2632 matches found
Razer US: Unauthenticated DOM-based XSS in pay.zvault.razerzone.com via the redir parameter.
Summary --- pay.zvault.razerzone.com is vulnerable to DOM-based XSS via the redir parameter. F219069 F219070 Affected Code --- js var redirectUrl = getUrlParameter'redir' // window.location.href; //alertredirectUrl; if isCrossOriginFrame window.location.href = redirectUrl; else...
Razer US: Authenticated DOM-based XSS in deals.razerzone.com via the rurl parameter.
The tester discovered the deals.razerzone.com website was vulnerable to open redirect via the rurl parameter e.g. https://deals.razerzone.com/user/ssologin?rurl= and that the parameter was also vulnerable DOM-based XSS. Also, the initial fix for this was a little too specific and edio was able to...
CVE-2017-13138
DOM based Cross-site scripting XSS vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers to inject arbitrary JavaScript...
Rockstar Games: dom based xss in http://www.rockstargames.com/GTAOnline/ (Fix bypass)
The researcher was able to bypass a previous fix for a DOM-Based XSS vulnerability 254343 by hashing part of the payload. This showed that our previous fix was insufficient, so we updated it to a more thorough solution...
Rockstar Games: dom based xss in https://www.rockstargames.com/GTAOnline/
In this report, the researcher found a DOM-Based XSS Vulnerability and was able to demonstrate an exploit that exposed cookie values. New 404 page handling code resulted in a fix for the issue...
Apple Mac OS X + Safari - Local Javascript Quarantine Bypass
Apple Mac OS X + Safari - Local Javascript Quarantine Bypass Title: Mac OS X Local Javascript Quarantine Bypass Product: Mac OS X Version: 10.12, 10.11, 10.10 and probably prior Vendor: apple.com Type: DOM Based XSS Risk level: 3 / 5 Credits: [email protected] CVE: N/A Vendor...
Apple Mac OS X + Safari - Local Javascript Quarantine Bypass
Title: Mac OS X Local Javascript Quarantine Bypass Product: Mac OS X Version: 10.12, 10.11, 10.10 and probably prior Vendor: apple.com Type: DOM Based XSS Risk level: 3 / 5 Credits: [email protected] CVE: N/A Vendor notification: 2017-07-15 Vendor fix: 2017-09-25 Public...
WakaTime: [wakatime.com] HTML Injection github-btn.html
Description === Vulnerable parameter: user Vulnerable script: https://wakatime.com/static/html/github-btn.html Vulnerable code: js var params = function var vars = , hash; var hashes = window.location.href.slicewindow.location.href.indexOf"?" + 1.split"&"; forvar i = 0; i...
Grab: [parcel.grab.com] DOM XSS at /assets/bower_components/lodash/perf/
Summary: DOM Based XSS or as it is called in some texts, “type-0 XSS” is an XSS attack wherein the attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser used by the original client side script, so that the client side code runs in an “unexpected” manner...
Grab: Dom based xss affecting all pages from https://www.grab.com/.
Hello, there's a dom based xss vulnerability affecting all pages under the domain https://www.grab.com/. This vulnerability wasn't properly patched so I managed to bypass the regular expressioned that was added into the function. Vulnerable code: var stripHtml = function var div =...
CVE-2017-6700
A vulnerability in the web-based management interface of Cisco Prime Infrastructure PI and Evolved Programmable Network Manager EPNM could allow an unauthenticated, remote attacker to conduct a Document Object Model DOM based environment or client-side cross-site scripting XSS attack against a us...
CVE-2017-6700
A vulnerability in the web-based management interface of Cisco Prime Infrastructure PI and Evolved Programmable Network Manager EPNM could allow an unauthenticated, remote attacker to conduct a Document Object Model DOM based environment or client-side cross-site scripting XSS attack against a us...
Cisco Prime Infrastructure and Evolved Programmable Network Manager DOM Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Prime Infrastructure PI and Evolved Programmable Network Manager EPNM could allow an unauthenticated, remote attacker to conduct a Document Object Model DOM based environment or client-side cross-site scripting XSS attack against a us...
Verizon Patches XSS Issues in its Messaging Client
Verizon late last year patched a vulnerability in its Message+ messaging client that could have allowed an attacker to take over a session and possibly extend their reach into a user’s account management settings. Researcher Randy Westergren yesterday disclosed some details on the bug, which coul...
WordPress: DOM Based XSS In mercantile.wordpress.org
Hello, There is a DOM XSS in mercantile.wordpress.org in the apparel subcat. For example: https://mercantile.wordpress.org/product-category/apparel/?subcat= Steps To Reproduce 1. Go to https://mercantile.wordpress.org 2. Click on apparel 3. In the url bar add : /?subcat=" The domain will pop-up. ...
WordPress < 4.7.5 Multiple Vulnerabilities
According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.7.5. It is, therefore, affected by multiple vulnerabilities : - A DOM-based cross-site scripting XSS vulnerability exists in the uploadSizeError function within file...
Zendesk: dom based xss in *.zendesk.com/external/zenbox/
See title...
Serviio PRO 1.8 DLNA Media Streaming Server (mediabrowser) XSS Vulnerability
Serviio PRO DLNA Media Streaming Server version 1.8.0.0 PRO, 1.7.1, 1.7.0, and 1.6.1 suffer from a mediabrowser cross site scripting vulnerability. Serviio PRO 1.8 DLNA Media Streaming Server mediabrowser DOM Based XSS Vendor: Petr Nejedly | Six Lines Ltd Product web page: http://www.serviio.org...
Serviio PRO 1.8 DLNA Media Streaming Server (mediabrowser) DOM Based XSS
Summary Serviio is a free media server. It allows you to stream your media files music, video or images to renderer devices e.g. a TV set, Bluray player, games console or mobile phone on your connected home network. Description The application is vulnerable to a DOM-based cross-site scripting. Da...