LastPass: global properties can be modified across isolated worlds, allowing remote code execution

A major part of the LastPass password manager is content scripts, additional privileged javascript that is injected into pages and can change or monitor content. LastPass use content scripts to search webpages for forms, add additional UI elements, and so on. The reason that it's safe to have...

DOM-based Cross-Site Scripting (XSS) in attribute context

Client-side scripts are used extensively by modern web applications. They perform from simple functions such as the formatting of text up to full manipulation of client-side data and Operating System interaction. Unlike traditional Cross-Site Scripting XSS, where the client is able to inject...

Unvalidated DOM redirect

Web applications occasionally use DOM input values to store the address of the page to which the client will be redirected -- for example: yoursite.com//?redirect=www.yoursite.com/404.asp An unvalidated redirect occurs when the client is able to modify the affected parameter value and thus contro...

DOM-based Cross-Site Scripting (XSS)

Client-side scripts are used extensively by modern web applications. They perform from simple functions such as the formatting of text up to full manipulation of client-side data and Operating System interaction. Unlike traditional Cross-Site Scripting XSS, where the client is able to inject...

Adobe Acrobat Force-Installed Vulnerable Chrome Extension

On January 12th, an automatic Adobe Acrobat update force installed a new chrome extension with ID efaidnbmnnnibpcajpcglclefindmkaj. You can view it on the Chrome Webstore here: https://chrome.google.com/webstore/detail/adobe-acrobat/efaidnbmnnnibpcajpcglclefindmkaj/ I can see from the webstore...

Interactive Multi User Javascript Shell: JSShell

Interactive Multi User Javascript Shell An interactive multi-user web based shell written in Python with Flask for server side and of course Javascript and HTML client side. It was initially created in order to debug remote esoteric browsers during tests and research. Features Multi client suppor...

RoundCube Webmail mail <1.0.5 body stored XSS（CVE-2015-1433）

RoundCube Webmail is a foreign use of a wide an open source php e-mail system, the meaning is still quite large. roundcube webmail official website: , download the latest version. /program/lib/Roundcube/rcubewashtml.php this file is actually a rich text filter class class rcubewashtml it. roundcu...

Mozilla Firefox Memory Misreference Vulnerability (CNVD-2017-04176)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the U.S. Thunderbird is a mail tool adapted from the mail widget of the Mozilla browser. A memory misreference vulnerability exists in Mozilla Firefox, where when adding a range to an object in the DOM, the range...

Nextcloud: DOM XSS vulnerability in search dialogue (NC-SA-2017-007)

DOM XSS vulnerability in search dialogue NC-SA-2017-007 Risk level: Low CVSS v3 Base Score: 2.6 AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N CWE: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CWE-79 Description Inadequate escaping lead to XSS vulnerability in the searc...

Mozilla Firefox < 52 Multiple Vulnerabilities

Binary data 9986.prm...

WordPress audio playlist functionality is affected by Cross-Site Scripting

Abstract Two Cross-Site Scripting vulnerabilities exists in the playlist functionality of WordPress. These issues can be exploited by convincing an Editor or Administrator into uploading a malicious MP3 file. Once uploaded the issues can be triggered by a Contributor or higher using the playlist...

WordPress < 4.7.3 Multiple Vulnerabilities

Binary data 9980.prm...

CVE-2017-5403

When adding a range to an object in the DOM, it is possible to use "addRange" to add the range to an incorrect root object. This triggers a use-after-free, resulting in a potentially exploitable crash. This vulnerability affects Firefox 52 and Thunderbird 52...

CVE-2016-8232

Document Object Model-DOM based cross-site scripting vulnerability in the Advanced Management Module AMM versions earlier than 66Z of Lenovo IBM BladeCenter HS22, HS22V, HS23, HS23E, HX5 allows an unauthenticated attacker with access to the AMM's IP address to send a crafted URL that could inject...

Cross site scripting

Document Object Model-DOM based cross-site scripting vulnerability in the Advanced Management Module AMM versions earlier than 66Z of Lenovo IBM BladeCenter HS22, HS22V, HS23, HS23E, HX5 allows an unauthenticated attacker with access to the AMM's IP address to send a crafted URL that could inject...

CVE-2016-8232

Summary of CVE-2016-8232 : A DOM-based cross-site scripting vulnerability affects IBM/LEN AMM (Advanced Management Module) for BladeCenter systems (HS22/HS22V/HS23/HS23E/HX5). The issue arises from improper validation of user input, allowing an unauthenticated attacker with AMM IP access to craft...

CVE-2016-8232

Document Object Model-DOM based cross-site scripting vulnerability in the Advanced Management Module AMM versions earlier than 66Z of Lenovo IBM BladeCenter HS22, HS22V, HS23, HS23E, HX5 allows an unauthenticated attacker with access to the AMM's IP address to send a crafted URL that could inject...

Starbucks: DOM XSS on teavana.com via "pr_zip_location" parameter

Hello Starbucks team,, I've discovered DOM XSS on teavana.com involving prziplocation URL parameter. PoC: http://www.teavana.com/us/en/tea/green-tea/winterberry-tea-blend-32601.html?prziplocation=//whitehat-hacker.com/xss.j? Works in all major browsers. Vulnerable code is in full.js: js var DR =...

Apple WebKit 10.0.2 - FrameLoader::clear Universal Cross-Site Scripting

Apple WebKit 10.0.2 - FrameLoader::clear Universal Cross-Site Scripting domWindow; mframe.document-domWindow-resetUnlessSuspendedForDocumentSuspension; mframe.script.clearWindowShellnewDocument-domWindow, mframe.document-pageCacheState == Document::AboutToEnterPageCache; / Apple WebKit: UXSS via...

Google Chrome: out-of-bound read in layout

Chrome bug: https://bugs.chromium.org/p/chromium/issues/detail?id=671328 PoC: content contain: size layout; function leak document.execCommand"selectAll"; opt.text = ""; aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Infoleak is demonstrated in th...