OLX: XSS on Meta Tag at https://m.olx.ph

Hi, There is improper validation at q parameter on https://m.olx.ph/ where it can be manipulated by an attacker to include his/her XSS payload to execute javascript code. As example: https://m.olx.ph/all-results?q=0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgndGVzdDMnKTwvc2NyaXB0Pg"...

Google Search Engine Rank Prefers HTTPS

Nothing in Google’s arsenal carries more weight than its search engine rankings. Pair that weapon with a desire to inspire encrypted connections on the web, and you have a pretty powerful combination. More than a year ago, Google said it was testing a method where a site’s search ranking would be...

Mozilla Firefox referrer policy bypass vulnerability

Mozilla Firefox is a popular open source WEB browser. When opening links via mid-click and context menus, Mozilla Firefo fails to properly enforce referer policies when handling meta tags, allowing remote attackers to perform unauthorized actions bypassing security restrictions...

JVN#75615300: All in One SEO Pack information management vulnerability

All in One SEO Pack is a WordPress plugin. All in One SEO Pack automatically adds a meta tag "Meta Description" to a page using some part of its contents, and this behavior is enabled in the initial configuration. Meta Description can be added even when a page is password-protected, therefore som...

CVE-2015-1614

Multiple cross-site request forgery CSRF vulnerabilities in the Image Metadata Cruncher plugin for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 imagemetadatacruncheralt or 2...

CVE-2015-1614

Multiple cross-site request forgery CSRF vulnerabilities in the Image Metadata Cruncher plugin for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 imagemetadatacruncheralt or 2...

Cross site scripting

Cross-site scripting XSS vulnerability in the path-based meta tag editing form in the Meta tags quick module 7.x-2.x before 7.x-2.8 for Drupal allows remote authenticated users with the "Edit path based meta tags" permission to inject arbitrary web script or HTML via vectors related to deleting a...

PT-2014-8961

Name of the Vulnerable Software and Affected Versions Drupal Meta tags quick module versions 7.x-2.x before 7.x-2.8 Description A cross-site scripting XSS issue exists in the path-based meta tag editing form, allowing remote authenticated users with the "Edit path based meta tags" permission to...

PT-2014-8962

Name of the Vulnerable Software and Affected Versions Drupal Meta tags quick module versions 7.x-2.x before 7.x-2.8 Description The issue allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via the destination parameter in the...

CVE-2014-9362: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the path-based meta tag editing form in the Meta tags quick module 7.x-2.x before 7.x-2.8 for Drupal allows remote authenticated users with the "Edit path based meta tags" permission to inject arbitrary web script or HTML via vectors related to deleting a...

AssetMan 2.5-b - SQL Injection using Session Fixation Attack

No description provided by source. ============================================================ AssetMan v2.5-b SQL Injection using Session Fixation Attack ============================================================ ; , ,; '. ;: :; :: :: :: :: ': : :. : ;' :: :: ' .' '; ;' '. :: :; ;: :: ; :;. ,...

Microsoft Internet Explorer 5.0.1 http-equiv Meta Tag Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10351/info It has been reported that Internet Explorer is prone to a denial of service vulnerability when processing a malicious script containing the 'window.createPopup' method to invoke the 'http-equiv' meta tag. This...

CVE-2014-4506

The CVE-2014-4506 issue is a Cross-Site Scripting (XSS) vulnerability in the Drupal Custom Meta module. Affected are Custom Meta 6.x-1.x prior to 6.x-1.2 and 7.x-1.x prior to 7.x-1.3. The root cause is insufficient sanitization of user input for meta tag attributes and content on the administrati...

CVE-2014-4506

Cross-site scripting XSS vulnerability in the Custom Meta module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "administer custom meta settings" permission to inject arbitrary web script or HTML via the 1 attribute or 2 content value for a...

CVE-2014-4506

Cross-site scripting XSS vulnerability in the Custom Meta module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "administer custom meta settings" permission to inject arbitrary web script or HTML via the 1 attribute or 2 content value for a...

CVE-2014-4506: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Custom Meta module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "administer custom meta settings" permission to inject arbitrary web script or HTML via the 1 attribute or 2 content value for a...

PT-2014-5938

Name of the Vulnerable Software and Affected Versions Custom Meta module versions 6.x-1.x before 6.x-1.2 Custom Meta module versions 7.x-1.x before 7.x-1.3 Description A cross-site scripting XSS issue exists, allowing remote authenticated users with the "administer custom meta settings" permissio...

CVE-2012-2729

Multiple cross-site request forgery CSRF vulnerabilities in the SimpleMeta module 6.x-1.x before 6.x-2.0 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 delete or 2 add a meta tag entry...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the SimpleMeta module 6.x-1.x before 6.x-2.0 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 delete or 2 add a meta tag entry...

CVE-2012-2729: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the SimpleMeta module 6.x-1.x before 6.x-2.0 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 delete or 2 add a meta tag entry...