PT-2019-9725

Name of the Vulnerable Software and Affected Versions Simditor versions prior to 2.3.22 Description The issue allows for DOM XSS via an onload attribute within a malformed SVG element. It is caused by the package not sanitizing user input that is rendered with innerHTML, allowing attackers to...

CVE-2018-19048: Improper Neutralization of Input During Web Page Generation

Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element...

Shopify: DOM XSS via Shopify.API.remoteRedirect

hi, team, after I read the report 422043, I found another monitor postmessage, and did not correctly verify the origin, leading to dom xss, using the store theme can write js this feature, we can modify a theme for the following Payload, function attack var...

QIWI: DOM XSS triggered in secure support desk

Summary Due to insufficient input sanitization, an attacker can send a crafted WebSocket message that will result in arbitrary code execution in the chat support backend, giving an attacker control to support tickets and client information. Technical details The vulnerability exists in line 2544 ...

Pandao editor.md vulnerable to DOM XSS

pandao Editor.md 1.5.0 has DOM XSS via input starting with a substring, which is mishandled during construction of an A element...

Cross site scripting

pandao Editor.md 1.5.0 has DOM XSS via input starting with a "" substring, which is mishandled during construction of an A element...

CVE-2018-19056

pandao Editor.md 1.5.0 has DOM XSS via input starting with a "" substring, which is mishandled during construction of an A element...

CVE-2018-19056

pandao Editor.md 1.5.0 has DOM XSS via input starting with a "" substring, which is mishandled during construction of an A element...

CVE-2018-19056

The CVE-2018-19056 entry concerns pandao Editor.md 1.5.0, with a DOM XSS flaw triggered by input starting with a <

CVE-2018-19056

pandao Editor.md 1.5.0 has DOM XSS via input starting with a "" substring, which is mishandled during construction of an A element...

CVE-2018-19056

pandao Editor.md 1.5.0 has DOM XSS via input starting with a "" substring, which is mishandled during construction of an A element...

PT-2018-14771

Name of the Vulnerable Software and Affected Versions pandao Editor.md version 1.5.0 Description The issue is related to DOM XSS, where input starting with a substring is mishandled during the construction of an A element. Recommendations For pandao Editor.md version 1.5.0, as a temporary...

CVE-2018-19056: Improper Neutralization of Input During Web Page Generation

pandao Editor.md 1.5.0 has DOM XSS via input starting with a "" substring, which is mishandled during construction of an A element...

XSStrike v3.0 - Most Advanced XSS Detection Suite

Why XSStrike? Every XSS scanner out there has a list of payloads, they inject the payloads and if the payload is reflected into the webpage, it is declared vulnerable but that's just stupid. XSStrike on the other hand analyses the response with multiple parsers and then crafts payloads that are...

DuckDuckGo: DOM XSS on 50x.html page on proxy.duckduckgo.com

Hi, I read the report about DOM XSS on 50x.html page https://hackerone.com/reports/405191. I decided to check some other subdomains to be sure. This link still executes javascript: https://proxy.duckduckgo.com/50x.html?e=&atb=test%22/%3E%3Cimg%20src=x%20onerror=alert%27test%27;%3E The following...

Shopify: H1514 DOM XSS on checkout.shopify.com via postMessage handler on /:id/sandbox/google_maps

Description: The /:id/sandbox/googlemaps and /:id/sandbox/googleautocomplete routes on checkout.shopify.com are used to render the Google Map on the "Order Status" page as well as the address prediction on checkout pages. The page performs origin validation on incoming postMessages making sure th...

Cloudflare: DOM XSS on 1.1.1.1(one.one.one.one)

After discussion with Cloudflare on twitter I'm reporting this here. There is a DOM XSS on 1.1.1.1 or one.one.one.one site, it seems like the sink is XMLHR.open,Taint,,, and the source is location.search The PoC url's are: https://1.1.1.1/?ApiLocation=//localdomain.pw...

PT-2018-18840

Name of the Vulnerable Software and Affected Versions Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier Description The issue allows adversaries to craft URLs that can modify the Document Object Model DOM of a page. Additionally, they can inject HTML script tags and HTML ta...

Starbucks: Reflected DOM XSS on www.starbucks.co.uk

Summary: www.starbucks.co.uk is vulnerable to reflected DOM XSS due to 2 seemingly unexploitable issues. The first issue is unfixed for over a year now, 252908, the second issue originates in a 3rd party module called prettyPhoto. Description: Visiting the following link results in a JavaScript...

Vanilla: XSS: Group search terms

Summary: The sub domain https://kentico.vanillastaging.com has a DOM XSS can be executed on any user browser by a simple get request. Description: The search param in the get request has been set in it's text value and the response has been reflected in the DOM response. Request: GET...