CVE-2018-0390

A vulnerability in the web framework of Cisco Webex could allow an unauthenticated, remote attacker to conduct a Document Object Model-based DOM-based cross-site scripting XSS attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input...

Cisco Webex DOM-Based Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco Webex could allow an unauthenticated, remote attacker to conduct a Document Object Model-based DOM-based cross-site scripting XSS attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input...

U.S. Dept Of Defense: █████ - DOM-based XSS

Greetings, I've discovered a DOM-based XSS at ███ Proof of concept: 1. Go to https://████/█████████/home/troubleshoot.html?lang=en 2. In the username field, add the following code: --button/autofocus/onfocus=Function"confirm1";//name="XSS 3. The javascript code is correctly executed: ██████ Impac...

U.S. Dept Of Defense: █████ - DOM-based XSS

Greetings, I've discovered a DOM-based XSS at ██████ Proof of concept: 1. Go to https://███/█████/home/troubleshoot.html?lang=en&returnUrl=https://█████/███████/home/signin.html?returnUrl=https%3A//████/██████████/home/user.html 2. In the username field, add the following code:...

Security Bulletin: Various security issues exist in WebSphere Service Registry and Repository version 8.0

Summary This bulletin describes a variety of minor security issues that have been found and fixed in WebSphere Service Registry and Repository version 8.0 Vulnerability Details CVE ID: CVE-2014-6153 DESCRIPTION: WSRR WEBUI ISSUES A COOKIE WHICH IS NOT DECLARED SSL ONLY. CVSS CVSS Base Score: 2.6...

Steam, Fire, and Paste – A Story of UXSS via DOM-XSS & Clickjacking in Steam Inventory Helper

Summary The “Steam Inventory Helper” Chrome extension version 1.13.6 suffered from both a DOM-based Cross-site Scripting XSS and a clickjacking vulnerability. By combining these vulnerabilities it is possible to gain JavaScript code execution in the highly-privileged context of the extension’s...

CVE-2018-11245

app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes...

CVE-2018-11245

CVE-2018-11245 affects MISP 2.4.91, with a DOM-based XSS flaw in app/webroot/js/misp.js related to cortex type attributes. The vulnerability allows injection of arbitrary scripts in web pages rendered by MISP; CVSS v3.0 base score 6.1 (Network, Low complexity, User interaction Required, Confident...

CVE-2018-11245

app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes...

PT-2018-10423 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP version 2.4.91 Description: The issue is related to a DOM-based XSS in the app/webroot/js/misp.js file, specifically with cortex type attributes. Recommendations: For MISP version 2.4.91, update to a newer version that contains a fix for...

CVE-2018-6958

Summary: CVE-2018-6958 affects VMware vRealize Automation (vRA) before 7.3.1, via a DOM-based XSS vulnerability that may lead to a compromised vRA user workstation. Affected versions: vRA 7.0.x, 7.1.x, 7.2.x, and 7.3.x before 7.3.1. Root cause: DOM-based XSS in the vRA interface. Impact: potentia...

VMSA-2018-0009:vRealize Automation updates address multiple security issues.

VMSA-2018-0009 vRealize Automation updates address multiple security issues VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2018-0009 VMware Security Advisory Severity: Important VMware Security Advisory Synopsis: vRealize Automation updates address multiple security issues...

MyCrypto: DOM Based XSS in mycrypto.com

Description & PoC The "connected successfully" message is printed out without any output sanitation: F271357 This is how it's being printedthis code snippet is taken from mycrypto-master.js, line 4072: F271359 An attacker can simply put his payload at the link and it'll be embedded within the pag...

Serviio PRO 1.8 DLNA Media Streaming Server (mediabrowser) DOM Based XSS

Summary Serviio is a free media server. It allows you to stream your media files music, video or images to renderer devices e.g. a TV set, Bluray player, games console or mobile phone on your connected home network. Description The application is vulnerable to a DOM-based cross-site scripting. Da...

Razer US: Authenticated DOM-based XSS in deals.razerzone.com via the rurl parameter.

The researcher discovered that deals.razerzone.com was vulnerable to Authenticated DOM-based XSS via the rurl parameter, which could allow account hijacking via session cookies. The researcher identified the specific code snippet and provided two PoCs with different techniques. Another great repo...

AlienVault : DOM-Based XSS in www.alienvault.com

Summary: There is a DOM-Based XSS vulnerability in the 'usma-code' parameter in /products/usm-anywhere/free-trial/thank-you-approved . Description: The link...

AlienVault : DOM Based XSS in https://threatcrowd.org

Hello AlienVault security team, I found a DOM Based XSS in https://threatcrowd.org via report function. Proof of Concept Steps to reproduce: 1. https://threatcrowd.org/report.php?report= 2. Fill in with this payload: javascript:promptdocument.domain 3. Send link to victim, when victim click in to...

Logitech Media Server DOM Based XSS Vulnerability

Logitech Media Server is prone to a dom based cross site scripting vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2017-15687

CVE-2017-15687 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Logitech Media Server. The issue affects multiple releases (7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, 7.9.1) and is exploitable via a crafted URI, as described across CVE records and OpenVAS entries. The root cause is DOM-b...

Mac OS X 10.12 isolation mechanism bypass vulnerability

Vulnerability summary Mac OS X a vulnerability exists that could allow an attacker to bypass the Apple of the isolation mechanism, without any restrictions to execute arbitrary JavaScript code. Vulnerability submitter From WeAreSegment security researcher Filippo Cavallarin to Beyond Security SSD...