Weblate: Browser Self XSS Protection not implemented

Hi Self XSS Protection not used ,An attacker can trick users to insert JavaScript in browser console. A Self-XSS scam usually works by promising to help you access somebody else's account. Instead, the scammer tricks you into gaining access to your account for fraud, spam and tricking more people...

Mail.ru: XSS on New contact

Self-XSS was reported for web.icq.com. According to bug bounty program's rules, self XSS reports are not considered...

Nextcloud: Self xss

Hello, I found self xss your main domain. I m sending details and I attached poc video. Pls open https://nextcloud.com/about/ Use burp suite and active intercept. Refresh this url. And pls add this payload your url. "alert205'"nextcloud.com Pls click intercept off and page refreshing. Now you see...

OX App Suite 7.8.4 XSS / XML Injection / Information Disclosure Vulnerabilities

OX App Suite version 7.8.5 suffers from XML external entity injection, information disclosure, and cross site scripting vulnerabilities. Product: OX App Suite Vendor: OX Software GmbH Internal reference: 58055 Bug ID Vulnerability type: XEE CWE-611 Vulnerable version: 7.8.4 Vulnerable component:...

CVE-2018-12580

library/DBTech/Security/Action/Sessions.php in DragonByte vBSecurity 3.x through 3.3.0 for vBulletin 3 and vBulletin 4 allows self-XSS via $session'useragent' in the "Login Sessions" feature...

Design/Logic Flaw

library/DBTech/Security/Action/Sessions.php in DragonByte vBSecurity 3.x through 3.3.0 for vBulletin 3 and vBulletin 4 allows self-XSS via $session'useragent' in the "Login Sessions" feature...

CVE-2018-12580

library/DBTech/Security/Action/Sessions.php in DragonByte vBSecurity 3.x through 3.3.0 for vBulletin 3 and vBulletin 4 allows self-XSS via $session'useragent' in the "Login Sessions" feature...

CVE-2018-12580

CVE-2018-12580 affects DragonByte vBSecurity 3.x up to 3.3.0 for vBulletin 3/4. The issue is a self-XSS in the Login Sessions feature caused by untrusted input in the session field $session['user_agent'], enabling an attacker to inject script/HTML. The Red Hat entry and CNVD/NVD records corrobora...

PT-2018-11266

Name of the Vulnerable Software and Affected Versions DragonByte vBSecurity versions 3.x through 3.3.0 for vBulletin 3 and vBulletin 4 Description The issue allows self-XSS via the user agent variable in the "Login Sessions" feature. This occurs in the library/DBTech/Security/Action/Sessions.php...

CVE-2018-12580: Improper Neutralization of Input During Web Page Generation

library/DBTech/Security/Action/Sessions.php in DragonByte vBSecurity 3.x through 3.3.0 for vBulletin 3 and vBulletin 4 allows self-XSS via $session'useragent' in the "Login Sessions" feature...

CVE-2017-7839

Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting self-XSS attacks where users are...

CVE-2017-7839

Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting self-XSS attacks where users are...

CVE-2017-7840

JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved bookmarks. If the resulting exported HTML file is later opened in a browser this JavaScript will be executed. This could be used in social engineering and self-cross-site-scripti...

Cross site scripting

Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting self-XSS attacks where users are...

CVE-2017-7839

Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting self-XSS attacks where users are...

CVE-2017-7839

Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting self-XSS attacks where users are...

CVE-2017-7839

Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting self-XSS attacks where users are...

CVE-2017-7840: Improper Neutralization of Input During Web Page Generation

JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved bookmarks. If the resulting exported HTML file is later opened in a browser this JavaScript will be executed. This could be used in social engineering and self-cross-site-scripti...

CVE-2017-7839: Improper Neutralization of Input During Web Page Generation

Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting self-XSS attacks where users are...

Cross-site Scripting (XSS)

symphonycms/symphony-2 is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of the page title parameter, allowing self XSS attacks to occur...