4244 matches found
LeaseWeb: DOM Based XSS in Checkout
Hey, This works in all browsers I suppose and regardless if the user is currently authenticated or not. Simply go over to : https://www.leaseweb.com/checkout-success/16893". Attached herewith is the screenshot. Thanks!...
X (Formerly Twitter): Multiple DOMXSS on Amplify Web Player
Hi, I would like to report multiple DOMXSS issues on https://amp.twimg.com/amplify-web-player/prod/source.html. Details: Please use latest IE to open all the PoCs because of CSP 1. $.get sink javascript define"data/playlist/withjsonloader", "require", "flight/lib/compose",...
ownCloud: owncloud.com: DOM Based XSS
Hello, there's DOM Based XSS In Main Page https://owncloud.com/"// Thanks...
The default WordPress Theme the presence of DOM XSS（cross-site scripting vulnerability affecting millions of users-vulnerability warning-the black bar safety net
! The use of the Genericons package of WordPress plugin or theme are likely to be affected by a DOM-basedXSSvulnerability, because of WordPress default theme Twenty Fifteen 及 知名 插件 Jetpack 都 包含 了 存在 漏洞 的 页面 example.html that affect millions of users. Vulnerability causes Any use of the genericons...
Java.com Cross Site Scripting
Exploit Title: Java.com RXSS and DOM-XSS Date: 01/04/2015 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.java.com Version: / Category: Reflected Cross Site Scripting and DOM based XSS Google dork: Tested on: Java.com main domain Java description :...
X2Engine < 3.7.4 Multiple Vulnerabilities
According to its version number, the X2Engine application installed on the remote web server is prior to version 3.7.4. It is, therefore, potentially affected by multiple vulnerabilities : - Multiple SQL injection vulnerabilities exist in the 'lastEventId' and 'lastTimestamp' HTTP GET parameters ...
██████: DOM based XSS on *.██████.com via document.domain sink in Safari
█████████████████████████████████...
Mail.ru: /surveys/2auth: DOM-based XSS
document.write''; в него попадаем, когда кука swalang=en для меня Firefox URL-encode-ит location, увы на IE должно прокатить при кейсе BlackFan-а когда другой сайт выдает location GET /surveys/2auth?a='"%20content="40"/%20alert123;!-- HTTP/1.1 Host: help.mail.ru User-Agent: Mozilla/5.0 Macintosh;...
CVE-2014-5391 DOM-based Cross-Site Scripting (XSS) in "JobScheduler"
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-5391 =================== "DOM-based Cross-Site Scripting XSS" CWE-79 vulnerability in "JobScheduler" product Vendor =================== Software- & Organisations-Service GmbH Product =================== "JobScheduler is a workload automation...
[ MDVSA-2014:183 ] phpmyadmin
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:183 http://www.mandriva.com/en/support/security/ Package : phpmyadmin Date : September 24, 2014 Affected: Business Server 1.0 Problem Description: Updated phpmyadmin package fixes security vulnerability: In...
Fedora 20 : phpMyAdmin-4.2.8.1-2.fc20 (2014-10981)
phpMyAdmin 4.2.8.1 2014-09-13 =============================== - security DOM based XSS that results to a CSRF that creates a ROOT account in certain conditions Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...
Mandriva Linux Security Advisory : phpmyadmin (MDVSA-2014:183)
Updated phpmyadmin package fixes security vulnerability : In phpMyAdmin before 4.2.9, by deceiving a logged-in user to click on a crafted URL, it is possible to perform remote code execution and in some cases, create a root account due to a DOM based XSS vulnerability in the micro history feature...
Fedora 21 : phpMyAdmin-4.2.8.1-2.fc21 (2014-10885)
phpMyAdmin 4.2.8.1 2014-09-13 =============================== - security DOM based XSS that results to a CSRF that creates a ROOT account in certain conditions Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...
openSUSE Security Update : phpMyAdmin (openSUSE-SU-2014:1150-1)
phpMyAdmin was updated to 4.1.14.4 2014-09-13 fixing bugs and security issues. - PMASA-2014-10 CVE-2014-6300, CWE-661 CWE-352 http://www.phpmyadmin.net/homepage/security/PMASA-2014- 10.php A DOM based XSS was fixed that resulted to a CSRF that creates a ROOT account in certain conditions...
Get Simple CMS 3.3.3 CSRF / XSS / Clickjacking
Affected Vendor: http://get-simple.info/ Date: 23/09/2014 Discovered by: JoeV Type of vulnerability: CSRF, Click-jacking, DOM based XSS and XSS Tested on: Windows 7 Version : 3.3.3 Description: Get Simple CMS v 3.3.3 is susceptible to multiple vulnerabilities such as CSRF, Click-jacking, DOM base...
Get Simple CMS 3.3.3 CSRF / XSS / Clickjacking Vulnerabilities
Get Simple CMS version 3.3.3 suffers from cross site request forgery, clickjacking, and various cross site scripting vulnerabilities. Affected Vendor: http://get-simple.info/ Date: 23/09/2014 Discovered by: JoeV Type of vulnerability: CSRF, Click-jacking, DOM based XSS and XSS Tested on: Windows ...
MGASA-2014-0383 Updated phpmyadmin package fix CVE-2014-6300
Updated phpmyadmin package fixes security vulnerability: In phpMyAdmin before 4.1.14.4, by deceiving a logged-in user to click on a crafted URL, it is possible to perform remote code execution and in some cases, create a root account due to a DOM based XSS vulnerability in the micro history featu...
Updated phpmyadmin package fix CVE-2014-6300
Updated phpmyadmin package fixes security vulnerability: In phpMyAdmin before 4.1.14.4, by deceiving a logged-in user to click on a crafted URL, it is possible to perform remote code execution and in some cases, create a root account due to a DOM based XSS vulnerability in the micro history featu...
FreeBSD : phpMyAdmin -- XSRF/CSRF due to DOM based XSS in the micro history feature (cc627e6c-3b89-11e4-b629-6805ca0b3d42)
The phpMyAdmin development team reports : XSRF/CSRF due to DOM based XSS in the micro history feature. By deceiving a logged-in user to click on a crafted URL, it is possible to perform remote code execution and in some cases, create a root account due to a DOM based XSS vulnerability in the micr...
phpMyAdmin -- XSRF/CSRF due to DOM based XSS in the micro history feature
The phpMyAdmin development team reports: XSRF/CSRF due to DOM based XSS in the micro history feature. By deceiving a logged-in user to click on a crafted URL, it is possible to perform remote code execution and in some cases, create a root account due to a DOM based XSS vulnerability in the micro...