CVE-2017-2307

A reflected cross site scripting vulnerability in the administrative interface of Juniper Networks Junos Space versions prior to 16.1R1 may allow remote attackers to steal sensitive information or perform certain administrative actions on Junos Space...

Reflective Cross-site Scripting Vulnerability in Multiple Parameters of SMi CMS School Website Management System

SMiCMS School Website Management System is a content management system for schools. A reflective cross-site scripting vulnerability exists in a number of parameters in the State Micro CMS University Edition, due to a failure to filter user-submitted parameters. These parameters include: module,...

Weblate: weblate.org: X-XSS-Protection not enabled

Hi, X-Xss-Protection @https://weblate.org has not been set. This header is used to configure the built in reflective XSS protection found in Internet Explorer, Chrome and Safari Webkit. Valid settings for the header are 0, which disables the protection, 1 which enables the protection and 1;...

PHPCMS V9 Full Version Has Reflective XSS Vulnerability

PHPCMS is a web content management system based on PHP and Mysql architecture. PHPCMS V9 full version of the existence of reflective XSS vulnerability, an attacker can use this vulnerability to web form to insert XSS execution code, pop-up box operation, access to user cookies and other sensitive...

PHPCMS V9 full version of the reflective XSS

No description provided by source...

AXIS Network Camera Cross Site Scripting

I. ADVISORY INFORMATION ----------------------- Title: Axis Network Cameras Multiple Cross-site scripting Vendor: Axis Communications Class: Improper Input Validation CWE-20 CVE Name: CVE-2015-8256 Remotely Exploitable: Yes Locally Exploitable: No OLSA-ID: OLSA-2015-8256 vulnerability -----------...

Open Source Cross Platform RAT: Pupy

Open Source Cross Platform RAT: Pupy Pupy is an opensource, cross-platform Windows, Linux, OSX, Android, multi function RAT Remote Administration Tool and post-exploitation tool mainly written in python. It features a all-in-memory execution guideline and leaves very low footprint. Pupy can...

Cicada-known CMS v5. 6 user-deny-reflective XSS vulnerability

Vulnerability overview Cicada-known open source version of the CMS v5. 6 in the user module of the deny method to render the template file, for user input of parameters for rendering, and not handled correctly, can lead to bypassing some of the filter, thereby causing the reflective XSS the...

WordPress plugin zibbra suffers from a reflective cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A reflective cross-site scripting vulnerability exists in the WordPress plugin zibbra 'GetAuthDetails.html.php' page, as the program fails to effectively filter...

WordPress plugin wowpth suffers from a reflective cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A reflective cross-site scripting vulnerability exists in the page parameter of the wordpress plugin wowpth 'createAdvancedTheme.php', which can be exploited by...

Knight Talent System (74cms) V3.7 Reflex Cross-Site Vulnerability

Knight Talent System 74cms is a PHP-based open source professional talent system. The system has a high implementation efficiency, free switching of templates, flexible background management functions and many other excellent features. Knight Talent System 74cms V3.7 version of the existence of...

Bypassing Ebay XSS Protection to launch XSS by Nirmal Dahal

This is a small proof of concept regarding “Reflective Cross-Site Scripting R-XSS ” which I had found on Ebay. I am not an active participant in bug bounty programs, but one day I had finished all my office works so I was surfing on Facebook and received a message from my brother, Samir, asking f...

PortSwigger Web Security: XSS in IE11 on portswigger.net via Flash

Hello Portswigger Security Team, There is a reflective XSS vulnerability in portswigger.net. The flash file https://portswigger.net/burp/tutorials/video-js/video-js.swf is from an old video.js library version 3.2.0 which is vulnerable to XSS. This XSS will be blocked by CSP instruction object-src...

ExpressionEngine: Reflective XSS

URL http://blackdoorsec.net/sandbox/express/admin.php?/cp/members/bans&search=&sortcol=me%22%3E%3Cimg%20src=x%20onerror=promptdocument.domain%3Emberid&sortdir=desc URL Parameters /cp/members/bans search= sortcol=me%22%3E%3Cimg%20src=x%20onerror=promptdocument.domain%3Emberid sortdir=desc The...

OLX: Reflective XSS at dubai.dubizzle.com

POC === 1 Visit: https://dubai.dubizzle.com/m/motors/used-cars/toyota/supra/2016/10/16/toyota-supra-original-left-hand-drive-duba-2-2/?back=amF2YXNjcmlwdDovLyUwQWFsZXJ0KGRvY3VtZW50LmRvbWFpbik=&fromsearch&highlightedads=1 2 Click on "Back" button in upper left hand corner Attack ==== URL Parameter...

OLX: Reflective XSS at m.olx.ph

URL https://m.olx.ph/mobile-phones-tablets/ph-'alert1'%3E%3Cimg%20src=x%3Easdf?q=qwerty Injection happens on lines 769, 770 and repeated also at 1005, 1006 urlNoCategory = '/ph-'alert1'%3E%3Cimg%20src=x%3Easdf?q=qwerty'; urlNoLocation =...

WebSummit: Reflective XSS

It appears the fix for https://hackerone.com/reports/166699 did not stick. URL https://websummit.net/attendees/featured-attendees?q=rubyoob%27%3E%3Ciframe/onload=alertdocument.domain%3E%3C/iframe%3E URL Parameters q=rubyoob%27%3E%3Ciframe/onload=alertdocument.domain%3E%3C/iframe%3E Request Header...

Kure 0.7.1 Cross Site Scripting

======================================================================== | Title : kure-0.7.1 XSS vulnerability | Author : indoushka | email : [email protected] | Tested on : windows 8.1 FranASSais V.Pro | Version : 0.7.1 | Vendor :...

Street Fighter 5 - 'Capcom.sys' Kernel Execution (Metasploit) Exploit

Exploit for windows platform in category local exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' require 'rex' class MetasploitModule...

Windows Capcom.sys Kernel Execution Exploit (x64 only)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' require 'rex' class MetasploitModule 'Windows Capcom.sys Kernel Execution Exploit x64 only',...