571 matches found
Imgur: CSRF leads to a stored self xss
Followup from 311460 Summary Self xss and CSRF are both out of scope, but when paired it is possible to create an attack on a user. Description A favorites folder with an xss payload for a name will launch when saving an image to said folder. This can be verified by following these steps Visit yo...
Fedora 26 : php-phpmyadmin-motranslator / php-phpmyadmin-sql-parser / etc (2018-147d33439c)
From upstream announcement : Security fix: phpMyAdmin 4.7.8 is released Welcome to phpMyAdmin 4.7.8, a security releaes also containing regular maintenance bug fixes. The security fix relates to a self-XSS vulnerability in the central columns feature that is reported as PMASA-2018-1...
Fedora 27 : php-phpmyadmin-motranslator / php-phpmyadmin-sql-parser / etc (2018-a1650ed14f)
From upstream announcement : Security fix: phpMyAdmin 4.7.8 is released Welcome to phpMyAdmin 4.7.8, a security releaes also containing regular maintenance bug fixes. The security fix relates to a self-XSS vulnerability in the central columns feature that is reported as PMASA-2018-1...
Self XSS in central columns feature
PMASA-2018-1 Announcement-ID: PMASA-2018-1 Date: 2018-02-20 Summary Self XSS in central columns feature Description A self-cross site scripting XSS vulnerability has been reported relating to the central columns feature. Severity We consider this vulnerability to be of moderate severity. Mitigati...
Self Cross-site Scripting (XSS)
concrete5 is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the user input for the saved search, allowing a malicious user to trick another user into performing a self XSS attack...
VK.com: self-xss ads_easy_promote vk.com
Self-XSS в рекламе...
VK.com: XSS работающая по всему сайту, где есть упоминания
Self-XSS в упоминаниях...
mozilla -- multiple vulnerabilities
Mozilla Foundation reports: CVE-2017-7828: Use-after-free of PressShell while restyling layout CVE-2017-7830: Cross-origin URL information leak through Resource Timing API CVE-2017-7831: Information disclosure of exposed properties on JavaScript proxy objects CVE-2017-7832: Domain spoofing throug...
Mail.ru: Self-xss via drag&drop in email form
User-assisted XSS in message composer's drag-n-drop feature via alt property of emoji-style image...
Shopify: Self-XSS in password reset functionality
Hi, When I opened this domain of yours, https://accounts.shopify.com/password-reset/new I just put the following text into email address box, [email protected] it change the colour of the text. Well my point here is that if you could inject HTML, you might be able to add a tag to the page. I...
Mail.ru: Stored self-XSS pubg.mail.ru в нескольких местах
Stored self-XSS in pubg.mail.ru via account name if login via social network is used. pubg.mail.ru is not currently in bug bounty scope...
VK.com: Хранимая XSS на странице "Виджет для авторизации"
Self-XSS на странице документации виджета. На счет того Self-XSS это или нет - оставляю на усмотрение общественности. Но лично мое мнение - команда vk тут все же ошибается. Для эксплуатации уязвимости атакующий должен был: Создать приложение с именем javascript:alert1;// Добавить атакуемого...
Mail.ru: XSS в портальной навигации
Stored self-XSS in portal navigation via external account name...
Weblate: Self-XSS can be achieved in the editor link using filter bypass
Description I saw the fixed issue in the https://hackerone.com/reports/223692 and i think i found another filter bypass. I noticed that we actually can use special keywords like %branchs, %files and %lines. So XSS can be achieved in this way: %branchs:alert1;//https:// if the branch will be named...
Quora: self xss in
Hi Quora security team, there is self XSS vulnerability in https://www.quora.com/profile/Username/ Steps: copy and paste the link in chrome browser copy entire link within double quotes "javascript:alertdocument.domain//https://www.quora.com/profile/Username/" then XSS payload will trigger please...
Mail.ru: Xss в https://e.mail.ru/
Приветствую , Я нашел xss на https://e.mail.ru/ , похоже, это self-xss, но, возможно,в будущем вы будите планировать расшаривать данную функциональность и это будет не self-xss, в том числе комбинация csrf logout/csrf login может расширить её функционал. Алсо, эта self-xss обходит текущие правила...
Mail.ru: Xss в https://e.mail.ru/
Привет, Я обнаружил xss на https://e.mail.ru/ , похоже, это self-xss, но вдруг в будущем планируется возможность расшаривать данную функциональность и это будет не self-xss, также атака csrf logout/csrf login может расширить её функционал. В том числе, это self-xss обходит текущие правила CSP. Дл...
WordPress: Self-XSS in WordPress Editor Link Modal
A self-xss was found in the link modal of the WordPress editor and fixed in the WordPress 4.8.2 release. Was a self-xss on the link modal and the WordPress team were very helpful and they made a patch for the bug happy to work with them :...
Weblate: Self XSS at translation page through Editor Link at demo.weblate.org
User input is not sanitized properly at Editor link causing self xss. Steps to reproduce 1 Navigate to https://demo.weblate.org/accounts/profile/preferences 2 Provide Editor link as javaScript:alertdocument.cookie;//confirm1; and click on Save 3 Navigate to English Translation page of the project...