Nextcloud: Content Spoofing/Text Injection - docs.nextcloud.org

Issue: ====== Hey, I've found content spoofing also known as "Text Injection" in your sub-domain docs.nextcloud.org URL: ------- Here is the malicious URL: https://docs.nextcloud.org/.htacessCONTENT%20SPOOFING%20BY%20AHSAN Fix: Use custom 403 error page which doesn't contain user's text! I hope...

SecNews: Text injection on error page.

An user or attacker is able to inject his text into error page and can trap to user to visit malicious sites. Even if the XSS or error custom based 404 pages error injecting is not on the scope of our program,our committee decided to disclose it publicly...

Vimeo: Error page Text Injection.

Error page text injection...

Trello: Error Page Text Injection.

AS we can see in report an user or attacker is able to inject his text into error page and can trap to user to visit other site by adding following link /test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.malicious.com%20so%20go%20to%20the%20new%20one%20since%20this%20one A...

Open redirect

Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging 1 custom code or 2 a form shown on a 404 error page, related to path manipulation...

UBUNTU-CVE-2016-3164

Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging 1 custom code or 2 a form shown on a 404 error page, related to path manipulation...

CVE-2016-3164

Removed by vendor...

hansme.com XSS vulnerability

Vulnerable URL: http://www.hansme.com/Admin/Error.aspx?Tip= Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 3279425 Google Pagerank| 3 VIP website status:| No Check hansme.com SSL...

RabbitMQ: /api/... XSS vulnerability

A cross-site scripting vulnerability was discovered in RabbitMQ, which allowed using api/ path info to inject and receive data. A remote attacker could use this flaw to create an "/api/..." URL, forcing a server error that resulted in the server returning an HTML page with embedded text from the...

Paragon Initiative Enterprises: Information Disclosure in Error Page

Hello, Here's an crafted URL which discloses web server used and version of same. https://paragonie.com/%PI Even-though most error pages are handled by generic pages in paragonie.com, above given 400 Bad Request sample is not handled. It seems this error page is because of Invalid URL Encoded %PI...

scuolesanbenedetto.ch XSS vulnerability

Vulnerable URL: http://scuolesanbenedetto.ch/biblioteca/error.php?message=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

Web Server Error Page Information Disclosure

The default error page sent by the remote web server discloses information that can aid an attacker, such as the server version and languages used by the web server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

withinsecurity: Error Page Text Injection #106350

Hello Team , Description : This report is similar to 106350 , as we can see in report an user or attacker is able to inject his text into error page and can trap to user to visit other site by adding following link...

sktmembership.co.kr XSS vulnerability

Vulnerable URL: http://sktmembership.co.kr/web/html/common/error/error.jsp?errMsg=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 19691...

Wordpress Fastest Cache plugin XSS Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress plugin wp-fastest-cache XSS Vulnerability Software Link: https://wordpress.org/plugins/wp-fastest-cache/ Version:0.8.5.5 Google dork: inurl:/wp-content/plugins/wp-fastest-cache The code in...

houtrecyclage.be XSS vulnerability

Vulnerable URL: http://www.houtrecyclage.be/site/error.php?url=http%3A%2F%2Fwww.houtrecyclage.be%2Ffr%2Fbonnes-raisons-34.htm=--!"...

RSA Certificate Manager and Registration Manager Directory Traversal Vulnerability

RSA Certificate Manager and Registration Manager is a certificate management and registration management program. The OneStep component of RSA Certificate Manager and Registration Manager fails to properly validate user input, allowing an attacker to submit a special KCSOSCERRORPAGE parameter to...

MediaWiki cross-site scripting vulnerability (CNVD-2015-05871)

MediaWiki is a free and free web-based Wiki engine developed and maintained by the Wikimedia Foundation and MediaWiki volunteers, which can be used to deploy in-house knowledge management and content management systems. A cross-site scripting vulnerability exists in MediaWiki's thumb.php script. ...

DEBIAN-CVE-2015-6730

Cross-site scripting XSS vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to "ForeignAPI images."...

CVE-2015-6729

Cross-site scripting XSS vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the rel404 parameter, which is not properly handled in an error page...