CVE-2019-16414

CVE-2019-16414 affects GFI Kerio Control v9.3.0. A DOM-based XSS flaw in the login path (e.g., login/?reason=failure&NTLM=) can be used to embed malicious code and exfiltrate a victim’s credentials in cleartext. Multiple connected sources (NVD, Red Hat advisories, CVE pages, CNVD, CVE lists, and ...

CVE-2019-16414: Improper Neutralization of Input During Web Page Generation

A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure&NTLM= URI...

PT-2019-14669

Name of the Vulnerable Software and Affected Versions GFI Kerio Control version 9.3.0 Description A DOM-based XSS issue allows the embedding of malicious code, enabling the manipulation of the login page. This can lead to the theft of a victim's cleartext credentials, which are sent back to an...

Cross site scripting

DOM-based cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.2 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2019-5975

CVE-2019-5975 affects Cybozu Garoon 4.6.0–4.10.2 with a DOM-based cross-site scripting vulnerability in the Portal component (CWE-79). Root cause: insufficient input validation allows an authenticated user to cause arbitrary script/HTML execution in the user’s browser via unspecified vectors. Imp...

PT-2019-17909

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 4.6.0 through 4.10.2 Description A DOM-based cross-site scripting issue allows remote authenticated attackers to inject arbitrary web script or HTML. Recommendations For Cybozu Garoon versions 4.6.0 through 4.10.2, updat...

CVE-2019-5975: Improper Neutralization of Input During Web Page Generation

DOM-based cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.2 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...

Escalation of Privilege in Twistlock

An HTML injection vulnerability has been identified in the Twistlock Console that can lead to a DOM based XSS attack under certain configurations. Ref , CVE-2019-1583 Successful exploitation of this vulnerability allows a Twistlock user with Operator capabilities to escalate privileges to that of...

Rockstar Games: Warehouse dom based xss may lead to Social Club Account Taker Over.

The researcher brought our attention to a DOM-based Cross-Site Scripting vulnerability. Although issues on rockstarwarehouse.com are typically out of scope, this had an explicit impact on Social Club account security, so we decided we needed to act. The vulnerability only affected Internet Explor...

Upserve : DOM Based XSS via postMessage at https://inventory.upserve.com/login/

Description DOM based XSS is possible at https://inventory.upserve.com/login/ due to insecure origin checking when receiving a postMessage. POC 1. Visit https://hq.upserve.com.████████/upservexss.html 2. Click link 3. View alert on https://inventory.upserve.com Vulnerable Code javascript...

WS-2019-0070

All current versions of jQuery Mobile JQM as of 2019-05-04 are vulnerable to DOM-based Cross-Site Scripting XSS via crafted URLs...

CVE-2019-3490

A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server OES allowing a remote attacker to execute javascript in the victims browser by tricking the victim into clicking on a specially crafted link. This affects OES versions OES2015SP1, OES2018, and...

Design/Logic Flaw

A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server OES allowing a remote attacker to execute javascript in the victims browser by tricking the victim into clicking on a specially crafted link. This affects OES versions OES2015SP1, OES2018, and...

CVE-2019-3490

CVE-2019-3490 describes a DOM-based XSS in the Netstorage component of Open Enterprise Server (OES). A remote attacker could execute JavaScript in a victim’s browser by enticing them to click a crafted link. Affected are OES2015SP1, OES2018, and OES2018SP1; older versions were not tested. The con...

CVE-2019-3490

A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server OES allowing a remote attacker to execute javascript in the victims browser by tricking the victim into clicking on a specially crafted link. This affects OES versions OES2015SP1, OES2018, and...

CVE-2019-3490: Improper Neutralization of Input During Web Page Generation

A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server OES allowing a remote attacker to execute javascript in the victims browser by tricking the victim into clicking on a specially crafted link. This affects OES versions OES2015SP1, OES2018, and...

PT-2019-16597

Name of the Vulnerable Software and Affected Versions Open Enterprise Server OES versions OES2015SP1, OES2018, and OES2018SP1 Description A DOM based XSS issue has been identified in the Netstorage component, allowing a remote attacker to execute javascript in the victim's browser by tricking the...

ZEIT: Reflected DOM-Based XSS On Due Lack Filter On Parameter ?next

Summary: Hello I found that the parameter next lacks filtering, allowing the attacker to exploit this vulnerability to redirect users to a malicious site + The Attacker Can Exploit this bug to redirect the user to Malcious Site + The attacker can execute JavaScript code in the user browser Becaus...

CVE-2019-3826

A stored, DOM based, cross-site scripting XSS flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts...

CVE-2019-3826

A stored, DOM based, cross-site scripting XSS flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts...