675 matches found
Mail.ru: DOM XSS on https://biz.mail.ru/domains/goto/mail/ via parameter pollution
DOM based XSS in biz.mail.ru...
Lyst: DOM XSS on http://talks.lystit.com
Description DOM XSS can be achieved via a postMessage due to an insecure postMessage handler being registered. POC 1. Visit https://gamer7112.com/lyst1.html 2. Click the link 3. View alert Vulnerable Code Located at http://talks.lystit.com/data-saloon-presentation/plugin/notes/notes.html javascri...
Basecamp: Possible DOM XSS on app.hey.com
Summary: Hello Team, While testing it was observed that on https://app.hey.com/, on Search box there is a possibility of XSS. Although the payload is reflected in the DOM but the CSP blocks the execution of the script, the XSS can happen if the CSP is somehow bypassed. The Subject parameter is...
U.S. Dept Of Defense: DOM XSS on https://www.███████
Description DOM XSS can be achieved due to missing sanitation when setting the source of an iframe. POC 1. Visit https://www.████frame.htmljavascript:alertdocument.domain 2. View alert Vulnerable Code javascript function Load str=document.location.hash,idx=str.indexOf'' ifidx=0 str=str.substr1;...
DuckDuckGo: DOM XSS on duckduckgo.com search
Hey there, there is a DOM XXS vulnerability on the https://duckduckgo.com/ search result page through the kp and kae parameters of the Cloud Save feature. POC URL:...
Froala WYSIWYG HTML Editor 3.1.1 Cross Site Scripting Vulnerability
Exploit for php platform in category web applications Product: Froala WYSIWYG HTML Editor Vendor: Froala CSNC ID: CSNC-2020-004 CVE ID: CVE-2019-19935 Subject: DOM XSS in Froala WYSIWYG HTML Editor Severity: Medium Effect: Remotely exploitable Author: Emanuel Duss Date: 2020-07-01 Introduction...
Froala WYSIWYG HTML Editor 3.1.1 Cross Site Scripting
COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: Froala WYSIWYG HTML Editor Vendor: Froala CSNC ID: CSNC-2020-004 CVE ID: CVE-2019-19935 Subject: DOM XSS in Froala WYSIWYG HTML Editor Severity: Medium Effect: Remotely exploitable Author: Emanuel Duss Date:...
Urban Dictionary: DOM XSS through ads
Multiple ads hosted on www.urbandictionary.com make the www.urbandictionary.com origin vulnerable to DOM XSS. Attached is an image of alertdocument.domain executing. The injection works in Firefox and Chrome. Visiting the following URL will probably cause an alert box displaying the document.doma...
DuckDuckGo: DOM XSS on duckduckgo.com search
Hello, The is a DOM XSS vulnerability on https://duckduckgo.com search through the norw parameter. PoC URL: https://duckduckgo.com/?q=a&norw=" Screenshot: F820482 Impact The attacker can execute JS code...
CVE-2020-5334: Improper Neutralization of Input During Web Page Generation
RSA Archer, versions prior to 6.7 P2 6.7.0.2, contains a Document Object Model DOM based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM...
PT-2020-18409
Name of the Vulnerable Software and Affected Versions RSA Archer versions prior to 6.7 P2 6.7.0.2 Description The issue is related to a Document Object Model DOM based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this by tricking a victim...
CVE-2020-5334
RSA Archer, versions prior to 6.7 P2 6.7.0.2, contains a Document Object Model DOM based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM...
Rockstar Games: DOM XSS on https://www.rockstargames.com/GTAOnline/feedback
In this report, the researcher identified a DOM-based Cross-Site Scripting vulnerability in the /GTAOnline/feedback endpoint. As we worked together on resolving this matter, the researcher helped us identify other parts of the GTA Online sub-site that suffered from the same vulnerability due to...
CVE-2019-19757: Improper Neutralization of Input During Web Page Generation
An internal product security audit of Lenovo XClarity Administrator LXCA discovered a Document Object Model DOM based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The...
CVE-2011-3606
A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DO...
Vulnerability hunting with Semmle QL: DOM XSS
In two previous blog posts part 1 and part 2, we talked about using Semmle QL in C and C++ codebases to find vulnerabilities such as integer overflow, path traversal, and those leading to memory corruption. In this post, we will explore applying Semmle QL to web security by hunting for one of...
CVE-2019-17581
tonyy dormsystem through 1.3 allows DOM XSS...
CVE-2019-17581
tonyy dormsystem through 1.3 allows DOM XSS...
