4469 matches found
johanneshoppe.github.io XSS vulnerability
Vulnerable URL: https://johanneshoppe.github.io/HTML5Security/examples/XSS-DOM-based/index.html?message=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly...
Cisco Secure Access Control Server Dom-Based Cross-Site Scripting Vulnerability
A vulnerability in the Cisco Secure Access Control Server ACS web interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing a Document Object Model DOM-based, environment or client side, cross-site scripting XSS attack. The vulnerability is due t...
X (Formerly Twitter): Multiple DOMXSS on Amplify Web Player
Hi, I would like to report multiple DOMXSS issues on https://amp.twimg.com/amplify-web-player/prod/source.html. Details: Please use latest IE to open all the PoCs because of CSP 1. $.get sink javascript define"data/playlist/withjsonloader", "require", "flight/lib/compose",...
ownCloud: owncloud.com: DOM Based XSS
Hello, there's DOM Based XSS In Main Page https://owncloud.com/"// Thanks...
The default WordPress Theme the presence of DOM XSS（cross-site scripting vulnerability affecting millions of users-vulnerability warning-the black bar safety net
! The use of the Genericons package of WordPress plugin or theme are likely to be affected by a DOM-basedXSSvulnerability, because of WordPress default theme Twenty Fifteen 及 知名 插件 Jetpack 都 包含 了 存在 漏洞 的 页面 example.html that affect millions of users. Vulnerability causes Any use of the genericons...
WordPress Twenty Fifteen 4.2.1 Cross Site Scripting
Information -------------------- Advisory by Netsparker. Name: DOM XSS Vulnerability in Twenty Fifteen WordPress Theme Affected Software : WordPress Affected Versions: 4.2.1 and probably below Vendor Homepage : https://wordpress.org/ and https://wordpress.org/themes/twentyfifteen/ Vulnerability...
X (Formerly Twitter): DOM based cookie bomb
Hi, I would like to report an issue that allows attackers to plant a "cookie bomb" on a victim's browser, so that the victim will be unable to access any Twitter services. PoC 1. Go to http://innerht.ml/pocs/twitter-dom-based-cookie-bomb/ 2. Click on the "DoS" link 3. Wait for a moment 4. Now...
Java.com Cross Site Scripting
Exploit Title: Java.com RXSS and DOM-XSS Date: 01/04/2015 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.java.com Version: / Category: Reflected Cross Site Scripting and DOM based XSS Google dork: Tested on: Java.com main domain Java description :...
X2Engine < 3.7.4 Multiple Vulnerabilities
According to its version number, the X2Engine application installed on the remote web server is prior to version 3.7.4. It is, therefore, potentially affected by multiple vulnerabilities : - Multiple SQL injection vulnerabilities exist in the 'lastEventId' and 'lastTimestamp' HTTP GET parameters ...
██████: DOM based XSS on *.██████.com via document.domain sink in Safari
█████████████████████████████████...
Microsoft Dynamics CRM 2013 SP1 Cross Site Scripting Vulnerability
Microsoft Dynamics CRM 2013 SP1 suffers from self-inflicted cross site scripting vulnerability. Product: Microsoft Dynamics CRM 2013 SP1 Vendor: Microsoft Corporation Vulnerable Versions: 6.1.1.132 DB 6.1.1.132 and probably prior Tested Version: 6.1.1.132 DB 6.1.1.132 Advisory Publication: Decemb...
Microsoft Dynamics CRM 2013 SP1 Cross Site Scripting
Advisory ID: HTB23245 Product: Microsoft Dynamics CRM 2013 SP1 Vendor: Microsoft Corporation Vulnerable Versions: 6.1.1.132 DB 6.1.1.132 and probably prior Tested Version: 6.1.1.132 DB 6.1.1.132 Advisory Publication: December 29, 2014 without technical details Vendor Notification: December 29, 20...
Self-XSS in Microsoft Dynamics CRM 2013 SP1
High-Tech Bridge Security Research Lab discovered a DOM-based self-XSS vulnerability in Microsoft Dynamics CRM 2013 SP1, which can be exploited to perform Cross-Site Scripting attacks against authenticated users. The vulnerability exists due to insufficient filtration of user-supplied input passe...
Mail.ru: /surveys/2auth: DOM-based XSS
document.write''; в него попадаем, когда кука swalang=en для меня Firefox URL-encode-ит location, увы на IE должно прокатить при кейсе BlackFan-а когда другой сайт выдает location GET /surveys/2auth?a='"%20content="40"/%20alert123;!-- HTTP/1.1 Host: help.mail.ru User-Agent: Mozilla/5.0 Macintosh;...
Cisco Adaptive Security Appliance DOM Cross-Site Scripting Vulnerability in WebVPN Portal
Cisco Adaptive Security Appliance ASA devices configured for WebVPN contain a DOM-based cross-site scripting vulnerability XSS within the Portal Login page. An unauthenticated, remote attacker who can convince a user to take a malicious action, could perform a XSS attack on the user. The...
CVE-2014-5391 DOM-based Cross-Site Scripting (XSS) in "JobScheduler"
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-5391 =================== "DOM-based Cross-Site Scripting XSS" CWE-79 vulnerability in "JobScheduler" product Vendor =================== Software- & Organisations-Service GmbH Product =================== "JobScheduler is a workload automation...
[ MDVSA-2014:183 ] phpmyadmin
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:183 http://www.mandriva.com/en/support/security/ Package : phpmyadmin Date : September 24, 2014 Affected: Business Server 1.0 Problem Description: Updated phpmyadmin package fixes security vulnerability: In...
Fedora 20 : phpMyAdmin-4.2.8.1-2.fc20 (2014-10981)
phpMyAdmin 4.2.8.1 2014-09-13 =============================== - security DOM based XSS that results to a CSRF that creates a ROOT account in certain conditions Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...
Mandriva Linux Security Advisory : phpmyadmin (MDVSA-2014:183)
Updated phpmyadmin package fixes security vulnerability : In phpMyAdmin before 4.2.9, by deceiving a logged-in user to click on a crafted URL, it is possible to perform remote code execution and in some cases, create a root account due to a DOM based XSS vulnerability in the micro history feature...
Fedora 21 : phpMyAdmin-4.2.8.1-2.fc21 (2014-10885)
phpMyAdmin 4.2.8.1 2014-09-13 =============================== - security DOM based XSS that results to a CSRF that creates a ROOT account in certain conditions Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...