Design/Logic Flaw

An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. A DOM-based XSS exists in the store part of the product...

CVE-2018-20736

CVE-2018-20736 affects WSO2 API Manager 2.1.0 and 2.6.0. The issue is a DOM-based XSS in the store component. Connected sources do not provide exploitation details. The NVD entry lists CVSSv3 base score 5.4 (Medium) and network attack with user interaction required. Patches/mitigations are refere...

CVE-2018-20736

An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. A DOM-based XSS exists in the store part of the product...

Cross-site Scripting (XSS)

editor.md is vulnerable to cross-site scripting XSS. The vulnerability exists because it allows embedding of external svg file such as EMBED SRC="data:image/svg+xml, allowing an attacker to launch dom-based cross-site scripting...

CVE-2019-9738

jimmykuu Gopher 2.0 has DOM-based XSS via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...

CVE-2019-9736

DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...

Default credentials

jimmykuu Gopher 2.0 has DOM-based XSS via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...

CVE-2019-9738

jimmykuu Gopher 2.0 has DOM-based XSS via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...

Design/Logic Flaw

Editor.md 1.5.0 has DOM-based XSS via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...

CVE-2019-9737

Editor.md 1.5.0 has DOM-based XSS via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...

Default credentials

DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...

CVE-2019-9737

Editor.md 1.5.0 has DOM-based XSS via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...

CVE-2019-9738

jimmykuu Gopher 2.0 has DOM-based XSS via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...

CVE-2019-9737

Summary: CVE-2019-9737 affects Editor.md 1.5.0 with a DOM-based XSS vulnerability triggered by vectors including the substring <EMBED SRC="data:image/svg+xml.** The root cause is persistent insufficient sanitization of user input that can introduce base64-encoded content, enabling script execu...

CVE-2019-9736

CVE-2019-9736 affects 1024Tools Markdown 1.0 with a DOM-based XSS vulnerability triggered by embedding an SVG data URL via the substring ‘<EMBED SRC="data:image/svg+xml'’. The NVD entries cite CVSS2/3 base scores of 4.3 (MEDIUM) and 6.1 (MEDIUM), respectively; attack vector is NETWORK (CVSS2) ...

CVE-2019-9737

Editor.md 1.5.0 has DOM-based XSS via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...

CVE-2019-9738

CVE-2019-9738 affects jimmykuu Gopher 2.0 and is a DOM-based XSS triggered via an embedded SVG payload in an EMBED SRC="data:image/svg+xml" string. Root cause: DOM-based XSS in the client-side handling of embeds. Impact is described by CVSS metrics in the sources: CVSS v2 base score 4.3 (Network,...

CVE-2019-9736

DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...

Rockstar Games: DOM based XSS on /GTAOnline/tw/starterpack/

In this report the researcher identified a DOM-based XSS vulnerability impacting localized versions of the https://www.rockstargames.com/GTAOnline/ site in varying locations. This attack also took advantage of an Open Redirect vulnerability on another part of the site to demonstrate how an attack...

Rockstar Games: DOM based XSS on /GTAOnline/de/news/article via "returnUrl" parameter

In this report, the researcher identified a DOM-based cross-site scripting vulnerability affecting localized versions of the GTA Online screenshots site, e.g. https://www.rockstargames.com/GTAOnline/jp/screens/. We have pushed out an update fixing this vulnerability so that it is no longer...