PUBG: RXSS to Stored XSS - forums.pubg.com | URL parameter

René Kroka found a Reflected XSS vulnerability that could be chained to a Stored XSS attack in the Invision Community forums software used by PUBG. By crafting a malicious URL the attacker is able to trigger Javascript to execute on their own page; known as Reflected XSS. The attacker then create...

find.youropia.gr IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-1036951 Security Researcher MajorInfluenza Helped patch 120 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting find.youropia.gr website and its users. Followin...

dailygood.org IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-1036913 Security Researcher MajorInfluenza Helped patch 120 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting dailygood.org website and its users. Following...

Design/Logic Flaw

JBoss KeyCloak: XSS in login-status-iframe.html...

CVE-2014-3656

CVE-2014-3656 corresponds to a JBoss KeyCloak cross-site scripting (XSS) in the login-status-iframe.html page. Public advisories describe that if a Keycloak deployment allows '*' as a permitted web origin in the admin console, crafted requests to login-status-iframe.html can inject arbitrary Java...

There’s an app for that: web skimmers found on PaaS Heroku

Criminals love to abuse legitimate services—especially platform-as-a-service Paas cloud providers—as they are a popular and reliable hosting commodity used to support both business and consumer ventures. Case in point, in April 2019 we documented a web skimmer served on code repository GitHub...

Microsoft OAuth Flaw Opens Azure Accounts to Takeover

A vulnerability in the way Microsoft applications use OAuth for third-party authentication could allow an attacker to take over Azure cloud accounts. OAuth is a protocol that allows app users to share data about their accounts with third-party websites or apps, so that when they sign into the app...

Security update for webkit2gtk3 (important)

openSUSE Security Update: Security update for webkit2gtk3 Announcement ID: openSUSE-SU-2019:2591-1 Rating: important References: 1155321 1156318 Cross-References: CVE-2019-8551 CVE-2019-8558 CVE-2019-8559 CVE-2019-8563 CVE-2019-8625 CVE-2019-8674 CVE-2019-8681 CVE-2019-8684 CVE-2019-8686...

Security update for webkit2gtk3 (important)

openSUSE Security Update: Security update for webkit2gtk3 Announcement ID: openSUSE-SU-2019:2587-1 Rating: important References: 1155321 1156318 Cross-References: CVE-2019-8551 CVE-2019-8558 CVE-2019-8559 CVE-2019-8563 CVE-2019-8625 CVE-2019-8674 CVE-2019-8681 CVE-2019-8684 CVE-2019-8686...

SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2019:3044-1)

This update for webkit2gtk3 to version 2.26.2 fixes the following issues : Webkit2gtk3 was updated to version 2.26.2 WSA-2019-0005 and WSA-2019-0006, bsc1155321 bsc1156318 Security issues addressed : CVE-2019-8625: Fixed a logic issue where by processing maliciously crafted web content may lead t...

CVE-2019-16763 XSS in Pannellum from 2.5.0 through 2.5.4

In Pannellum from 2.5.0 through 2.5.4 URLs were not sanitized for data URIs or vbscript:, allowing for potential XSS attacks. Such an attack would require a user to click on a hot spot to execute and would require an attacker-provided configuration. The most plausible potential attack would be if...

MGASA-2019-0324 Updated webkit2 packages fix security vulnerabilities

Updated webkit2 packages fix security vulnerabilities: Processing maliciously crafted web content may lead to universal cross site scripting CVE-2019-8625, CVE-2019-8674, CVE-2019-8719, CVE-2019-8813 Processing maliciously crafted web content may lead to arbitrary code execution CVE-2019-8707,...

Debian DSA-4558-1 : webkit2gtk - security update

Several vulnerabilities have been discovered in the webkit2gtk web engine : - CVE-2019-8625 Sergei Glazunov discovered that maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8720 Wen Xu discovered that maliciously crafted web content may lead to arbitrary code...

Mozilla Firefox ESR < 24.7 Multiple Vulnerabilities

Binary data 701246.prm...

Unspecified Vulnerability in Apple iOS WebKit Component

Apple iOS is an operating system developed by Apple for mobile devices, of which WebKit is a component of the Web browser engine. A security vulnerability exists in the WebKit component in versions of Apple iOS prior to 13, which can be exploited by attackers to violate iframe sandboxing policies...

[SECURITY] [DSA 4558-1] webkit2gtk security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4558-1 [email protected] https://www.debian.org/security/ Alberto Garcia November 04, 2019 https://www.debian.org/security/faq -...

CVE-2019-8771

This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1, iOS 13. Maliciously crafted web content may violate iframe sandboxing policy...

UBUNTU-CVE-2019-8771

This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1, iOS 13. Maliciously crafted web content may violate iframe sandboxing policy...

CVE-2017-7787

Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to information disclosure. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox 55...

New Relic: Cross-account stored XSS at embedded charts

Hey team, I've discovered one more stored XSS, this one is at the embedded chart page. Steps tp reproduce 1 Sign into NR, navigate to any Mobile app - Interactions 2 Click ... near any chart, then choose Embed. Select OK at the confirm box. 3 Intercept the chart embedding POST request: http POST...