CVE-2020-6847

OpenTrade through 0.2.0 has a DOM-based XSS vulnerability that is executed when an administrator attempts to delete a message that contains JavaScript...

CVE-2020-6847: Improper Neutralization of Input During Web Page Generation

OpenTrade through 0.2.0 has a DOM-based XSS vulnerability that is executed when an administrator attempts to delete a message that contains JavaScript...

PT-2020-19261

Name of the Vulnerable Software and Affected Versions OpenTrade versions 0.2.0 and earlier Description The issue is related to a DOM-based XSS vulnerability. It occurs when an administrator tries to delete a message containing JavaScript. Recommendations For OpenTrade versions 0.2.0 and earlier,...

CVE-2019-18652

A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to execute JavaScript in the victim's browser by tricking the victim into clicking on a crafted link. The payload was tested in Microsoft Internet Explorer 11.418.18362.0 and...

Design/Logic Flaw

A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to execute JavaScript in the victim's browser by tricking the victim into clicking on a crafted link. The payload was tested in Microsoft Internet Explorer 11.418.18362.0 and...

PT-2020-9979

Name of the Vulnerable Software and Affected Versions: WatchGuard XMT515 versions prior to 12.1.3 Description: A DOM based XSS issue allows a remote attacker to execute JavaScript in the victim's browser by tricking the victim into clicking on a crafted link. The issue was tested in Microsoft...

CVE-2019-18652: Improper Neutralization of Input During Web Page Generation

A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to execute JavaScript in the victim's browser by tricking the victim into clicking on a crafted link. The payload was tested in Microsoft Internet Explorer 11.418.18362.0 and...

CVE-2019-5989

The CVE-2019-5989 issue is a DOM-based cross-site scripting vulnerability in the Analysis Object Page of Access analysis CGI An-Analyzer (released around 2019-06-24). The root cause is DOM-based XSS that could allow a remote attacker to inject arbitrary web script or HTML via the Analysis Object ...

PT-2020-11189

Name of the Vulnerable Software and Affected Versions An-Analyzer versions prior to the version released after 2019 June 24 Description A DOM-based cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the Analysis Object Page. Recommendations For An-Analyz...

CVE-2019-5989: Improper Neutralization of Input During Web Page Generation

DOM-based cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers to inject arbitrary web script or HTML via the Analysis Object Page...

Razer: dom based xss on [hello.merchant.razer.com]

The tester discovered a DOM based xss on a Razer Merchant Services status server, associated with an unneeded application. Razer Fintech appreciates the tester bringing this to their attention and the clear PoC...

CVE-2011-3606: Improper Neutralization of Input During Web Page Generation

A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DO...

LY Corporation: DOM-based XSS on mobile.line.me

The reporter found a DOM-based XSS affecting mobile.line.me, which could have resulted in an attacker gaining access to information about a user's mobile plans, usage and user details registered as part of their mobile subscription plan...

Vulnerability hunting with Semmle QL: DOM XSS

In two previous blog posts part 1 and part 2, we talked about using Semmle QL in C and C++ codebases to find vulnerabilities such as integer overflow, path traversal, and those leading to memory corruption. In this post, we will explore applying Semmle QL to web security by hunting for one of­­­...

U.S. Dept Of Defense: [█████] — DOM-based XSS on endpoint `/?s=`

Description GET parameter s is vulnerable to DOM-based XSS on endpoint /?s=. XSS affects all users and no authentication or login is required. Proof of Concept Visit the following URL for PoC: https://██████/?s=%27%3E%3Cscript%3Ealertdocument.domain%3C/script%3E █████████ Explanation This DOM-bas...

CVE-2019-16414

A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure&NTLM= URI...

CVE-2019-16414

A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure&NTLM= URI...

Default credentials

A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure&NTLM= URI...

ForeScout Technologies: DOM XSS at www.forescout.com in Microsoft Edge and IE Browser

Summary: I've found an DOM Based XSS on homepage Steps To Reproduce: 1.Go to this url and you'll see alert pop https://www.forescout.com/ But this will work just on ME/IE browsers because chrome and firefox have default encode system hash url And vulnerable code is on your directly source code...

CVE-2019-16414

A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure&NTLM= URI...