Cross site scripting

The print snippet resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a comment on the snippet...

CVE-2017-18092

The print snippet resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a comment on the snippet...

Keybase: Claiming ownership of GitHub handles via forked GitHub gists.

Description An attacker can claim ownership of a GitHub user's handle if the user forks the attacker's gist with a verification snippet generated by the attacker pointing towards the user's handle. PoC With my colleague's permission @jackds I claimed their GitHub handle with this gist:...

CVE-2017-8802

Cross-site scripting XSS vulnerability in Zimbra Collaboration Suite aka ZCS before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script or HTML via vectors related to the "Show Snippet" functionality...

CVE-2017-8802

Cross-site scripting XSS vulnerability in Zimbra Collaboration Suite aka ZCS before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script or HTML via vectors related to the "Show Snippet" functionality...

Cross site scripting

Cross-site scripting XSS vulnerability in Zimbra Collaboration Suite aka ZCS before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script or HTML via vectors related to the "Show Snippet" functionality...

Razer US: Authenticated DOM-based XSS in deals.razerzone.com via the rurl parameter.

The researcher discovered that deals.razerzone.com was vulnerable to Authenticated DOM-based XSS via the rurl parameter, which could allow account hijacking via session cookies. The researcher identified the specific code snippet and provided two PoCs with different techniques. Another great repo...

Open-Xchange: IDOR - Deleting other user's signature via /appsuite/api/snippet?action=update (although an error is thrown)

Hello again, I have found that everybody can delete everybody's signature via a malformed PUT request in /appsuite/api/snippet?action=update. Although a processing error is thrown, the targeted signature is deleted. POC ------------------ PUT...

WordPress Plugin Insert Html Snippet Cross-Site Request Forgery Vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . A cross-site request forgery vulnerability exists in Wordpress plugin Insert Html Snippet version 1.2. The...

WordPress Insert Html Snippet 1.2 Cross Site Request Forgery Vulnerability

WordPress Insert Html Snippet plugin version 1.2 suffers from a cross site request forgery vulnerability. ------------------------------------------------------------------------ Cross-Site Request Forgery in Insert Html Snippet WordPress Plugin...

Insert Html Snippet <= 1.2 - Cross-Site Request Forgery (CSRF)

The Insert Html Snippet WordPress plugin was affected by a Cross-Site Request Forgery CSRF security vulnerability...

WordPress Insert Html Snippet 1.2 Cross Site Request Forgery

------------------------------------------------------------------------ Cross-Site Request Forgery in Insert Html Snippet WordPress Plugin ------------------------------------------------------------------------ Yorick Koster, July 2016...

Brave Software: [DOS] Browser hangs on loading the code snippet

Summary: Basically the function location.reload is causing browser to hang as browser is not able to handle multiple reloads but similar issue cannot be seen in Firefox and chrome as i am able to close the current tab. Products affected: Latest brave browser in linux. Steps To Reproduce: Use the...

Brave Software: [DOS] denial of service using code snippet on brave browser

Summary: brave browser hangs due to no validation for a code snippet causing denial of service to users. Products affected: latest brave browser in linux Steps To Reproduce: code snippet:- 1 window.location+='?\u202a\uFEFF\u202b'; OR 2 window.location+='?'+window.location.toString.split'';" Note ...

krb5 security, bug fix, and enhancement update

1.14.1-26 - Use responder in non-preauth AS reqs - Resolves: 1363690 1.14.1-25 - Fix bad debuglog call in selinux handling - Resolves: 1292153 1.14.1-24 - Fix KKDCPP with TLS SNI by always presenting 'Host:' header - Resolves: 1364993 1.14.1-23 - Add dependency on libkadm5 to krb5-devel - Resolve...

ZineBasic 1.1 Remote File Disclosure

Title: ZineBasic 1.1 Remote File Disclosure Exploit Author: bd0rk || East Germany former GDR Tested on: Ubuntu-Linux Vendor: http://w2scripts.com/news-publishing/ Download:...

django CMS 3.3.0 - (Editor, Snippet) stored XSS

No description provided by source...

Django CMS v3.3.0 - (Editor Snippet) Persistent Vulnerability

Document Title: =============== Django CMS v3.3.0 - Editor Snippet Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1869 Security Release: https://www.djangoproject.com/weblog/2016/jul/18/security-releases/...

[SECURITY] Fedora 24 Update: drupal7-block_class-2.3-1.fc24

Block Class allows users to add classes to any block through the block's configuration interface. By adding a very short snippet of PHP to a theme's block.tpl.php file, classes can be added to the parent element of a block. This package provides the following Drupal module: blockclass...

Critical: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.2.0 update

Red Hat JBoss BPM Suite 6.2.0, which fixes three security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System CVSS base scores...