Concrete CMS: Stored XSS vulnerability in additional URLs in 'Location' dialog [Sitemap]

Intro "Transformers: Dark of the Crayons" Type of issue: Core CMS issue Level of severity: Internal Attack Vector Concrete5 version: 8.2.0 RC2 rev. 0a26b63c4a64d42e7afb36aba0a6e4d1f4c53d7d July 19th Summary There is Stored XSS vulnerability in additional URLs in 'Location' dialog. This issue can ...

rutronik24.com XSS vulnerability

Vulnerable URL: https://www.rutronik24.com/index.php?m=oc=sitemap==01A"--!"=02ATRI Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 276913 VIP website status:| No Check rutronik24.co...

pickatyre.com XSS vulnerability

Open Bug Bounty ID: OBB-230301 Description| Value ---|--- Affected Website:| pickatyre.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

daisychaingiftcompany.com XSS vulnerability

Open Bug Bounty ID: OBB-230264 Description| Value ---|--- Affected Website:| daisychaingiftcompany.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

oldbyre.co.uk XSS vulnerability

Vulnerable URL: http://www.oldbyre.co.uk/sitemap.jsp?a=test%22%27--!%3E%3CImage%0CSrcset%3DK%0COnerror%3DconfirmOPENBUGBOUNTY%0C Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

labelladonna.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-230243 Description| Value ---|--- Affected Website:| labelladonna.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

snowcentraluk.com XSS vulnerability

Vulnerable URL: http://www.snowcentraluk.com/sitemap.jsp?a=test%22%27--!%3E%3CImage%0CSrcset%3DK%0COnerror%3DconfirmOPENBUGBOUNTY%0C Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

classiccollectionsgiftshop.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-230195 Description| Value ---|--- Affected Website:| classiccollectionsgiftshop.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6....

meirionmill.co.uk XSS vulnerability

Vulnerable URL: http://www.meirionmill.co.uk/sitemap.jsp?a=test%22%27--!%3E%3CImage%0CSrcset%3DK%0COnerror%3DconfirmOPENBUGBOUNTY%0C Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

mincost.co.uk XSS vulnerability

Vulnerable URL: http://www.mincost.co.uk/sitemap.jsp?a=test%22%27--!%3E%3CImage%0CSrcset%3DK%0COnerror%3DconfirmOPENBUGBOUNTY%0C Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 21227615 VIP website status:| No...

trusports.com.au XSS vulnerability

Vulnerable URL: https://www.trusports.com.au/sitemap.jsp?a=test%22%27--!%3E%3CImage%0CSrcset%3DK%0COnerror%3DconfirmOPENBUGBOUNTY%0C Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

Web Application Sitemap

Publishes the sitemap of the web application as seen by the scan. The list of all URLs that have been detected during the scan are available as an attachment. For each URL in the sitemap, the following information is provided: - The first time the URL is detected - The logic used to detect the UR...

swarm - A Modular Distributed Penetration Testing Tool

Swarm is an open source modular distributed penetration testing Tool that use distributed task queue to implement communication in the master-slave mode system and use MongoDB for data storage. It consists of a distributed framework and function modules. The function module can be an entirely new...

Zomato: Visibility Robots.txt file

Issue detail:- The web server contains a robots.txt file. Issue background:- The file robots.txt is used to give instructions to web robots, such as search engine crawlers, about locations within the web site that robots are allowed, or not allowed, to crawl and index. The presence of the...

Drupal XML Sitemap Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. XML Sitemap is one of the modules that makes it easy for search engines to intelligently index Drupal. A cross-site scripting vulnerability exists in Drupal XML Sitemap versions 7.x-2....

Web Application Sitemap

The remote web server contains linkable content that can be used to gather information about a target. C Tenable Network Security, Inc. if NASLLEVEL 5201 exit0, "webmirror3.nbin is required."; include"compat.inc"; ifdescription scriptid91815; scriptversion "$Revision: 1.1 $"; scriptcvsdate"$Date:...

XML Sitemap - Moderately Critical - XSS - SA-CONTRIB-2016-030

The XML Sitemap module enables you to create sitemaps which help search engines to more intelligently crawl a website and keep their results up to date. The module doesn't sufficiently filter the URL when it is displayed in the sitemap. This vulnerability is mitigated if the setting for "Include ...

cdn.attracta.com XSS vulnerability

Vulnerable URL: https://cdn.attracta.com/sitemap/338118/search.html?q=%3C/title%3E%3C/script/%22-alert%280%29-%22--%3E%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

e-planet.ru XSS vulnerability

Vulnerable URL: http://e-planet.ru/sitemap/search/?searchquery=' autofocus onfocus='alert/XSSPOSED/ Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 17:48 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 443960...

Cross-Site Scripting in extension "Google Sitemap" (enter_new_weeaar_googlesitemap)

It has been discovered that the extension "Google Sitemap" enternewweeaargooglesitemap is susceptible to Cross-Site Scripting. Release Date: March 03, 2016 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 1.0.0 and...