10202 matches found
JetBlue: Dom-Based XSS on parameter ?vsid=
Researcher found a DOM XSS vulnerability in one of the JetBlue applications using the vsid parameter. The researcher used the below payload to trigger XSS: ';alert1;//...
CVE-2021-42357 DOM based XSS Vulnerability in Apache Knox
When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be...
Cross-site Scripting (XSS) - Stored in saleor/saleor-dashboard
Description Because the dangerouslySetInnerHTML method is used to output the input value of the DOM, XSS vulnerabilities occur in many logics. Proof of Concept html " Impact Through this vulnerability, an attacker is capable to execute malicious scripts...
scratch-svg-renderer cross-site scripting vulnerability
scratch-svg-renderer is a code library used by the Scratch team to convert SVG to DOM elements. scratch-Svg-Renderer suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data in WEB applications, which can be exploited to execute client-si...
Cross-site Scripting (XSS) - DOM in mrdoob/three.js
Description DOM-based XSS is a vulnerability in which the attacker can inject arbitrary javascript code in any DOM sink that supports dynamic code execution. In our case, source is window.location.hash and sink is iframe.src Proof of Concept 1 Visit...
Cross-site Scripting (XSS) - DOM in karma-runner/karma
Description DOM-based XSS is a vulnerability in which the attacker can inject arbitrary javascript code in any DOM sink that supports dynamic code execution. In our case, source is query parameter returnurl and sink is location.href. Proof of Concept 1 Start karma server and visit the following...
Cross-site Scripting (XSS)
scratch-svg-renderer is vulnerable to cross-site scripting. An attacker is able to inject maliciously crafted sb3 file via the HTML DOM object model interface...
CVE-2020-27428
A DOM-based cross-site scripting XSS vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file...
Cross site scripting
A DOM-based cross-site scripting XSS vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file...
CVE-2020-27428
CVE-2020-27428 affects the Scratch-Svg-Renderer library (v0.2.0). The vulnerability is described as a DOM-based cross-site scripting (XSS) issue that allows an attacker to execute arbitrary web scripts or HTML through a crafted sb3 file. The cited impact indicates possible code execution in the c...
CMSimple 5.4 Cross Site Scripting
Exploit Title: CMSimple 5.4 - Cross Site Scripting XSS Date: 22/10/2021 Exploit Author: heinjame Vendor Homepage: https://www.cmsimple.org/en/ Software Link: https://www.cmsimple.org/en/?Downloads Version: images Upload a file Attack vector '-alert1// need to encode '-alert1// When the victim...
CMSimple 5.4 - Cross Site Scripting Vulnerability
Exploit Title: CMSimple 5.4 - Cross Site Scripting XSS Exploit Author: heinjame Vendor Homepage: https://www.cmsimple.org/en/ Software Link: https://www.cmsimple.org/en/?Downloads Version: images Upload a file Attack vector '-alert1// need to encode ' When the victim clicks the delete button,an...
CMSimple 5.4 - Cross Site Scripting (XSS)
Exploit Title: CMSimple 5.4 - Cross Site Scripting XSS Date: 22/10/2021 Exploit Author: heinjame Vendor Homepage: https://www.cmsimple.org/en/ Software Link: https://www.cmsimple.org/en/?Downloads Version: images Upload a file Attack vector '-alert1// need to encode ' When the victim clicks the...
Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot
Title XSS in markdown link-maker Description While chatting with a client, both sides may use markdown. However, neither client's nor Chatwoot inner user's input is verified. Steps to reproduce. Note: this works in Safari and Firefox, not Chrome. I will use Telegram bot. 1. 1. Start a conversatio...
[SECURITY] Fedora 35 Update: seamonkey-2.53.10.1-1.fc35
SeaMonkey is an all-in-one Internet application suite previously made popular by Netscape and Mozilla. It includes an Internet browser, advanced e-mail, newsgroup and feed client, a calendar, IRC client, HTML editor and a tool to inspect the DOM for web pages. It is derived from the application...
AbanteCart Cross-Site Scripting Vulnerability (CNVD-2021-102795)
AbanteCart is a PHP-based e-commerce platform. AbanteCart 1.3.2 previously had a security vulnerability that could be exploited by attackers to conduct DOM-based XSS attacks...
dom-sharikov.ru Cross Site Scripting vulnerability OBB-2305521
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
GHSA-2HFJ-CXW7-G45P Unsafe inline XSS in pasting DOM element into chat
Impact Inline scripts are executed when Javascript is parsed via a paste action. 1. Open https://watch.owncast.online/ 2. Copy and then paste into the chat field. 3. An alert should pop up. Patches ⋮ 13 │ // Content security policy ⋮ 14 │ csp := string ⋮ 15 │ "script-src 'self'...
Unsafe inline XSS in pasting DOM element into chat
Impact Inline scripts are executed when Javascript is parsed via a paste action. 1. Open https://watch.owncast.online/ 2. Copy and then paste into the chat field. 3. An alert should pop up. Patches ⋮ 13 │ // Content security policy ⋮ 14 │ csp := string ⋮ 15 │ "script-src 'self'...