764 matches found
CVE-2017-18095
The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 the fixed version 4.5.x and before 4.6.0 allows remote attackers to comment on snippets they do not have authorization to access via an improper authorization vulnerability...
PT-2018-6671
Name of the Vulnerable Software and Affected Versions: Atlassian Crucible versions prior to 4.4.3 Atlassian Crucible versions prior to 4.5.0 Description: The issue allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a...
CVE-2017-18092: Improper Neutralization of Input During Web Page Generation
The print snippet resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a comment on the snippet...
Keybase: Claiming ownership of GitHub handles via forked GitHub gists.
Description An attacker can claim ownership of a GitHub user's handle if the user forks the attacker's gist with a verification snippet generated by the attacker pointing towards the user's handle. PoC With my colleague's permission @jackds I claimed their GitHub handle with this gist:...
CVE-2017-8802
Cross-site scripting XSS vulnerability in Zimbra Collaboration Suite aka ZCS before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script or HTML via vectors related to the "Show Snippet" functionality...
CVE-2017-8802
Cross-site scripting XSS vulnerability in Zimbra Collaboration Suite aka ZCS before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script or HTML via vectors related to the "Show Snippet" functionality...
Cross site scripting
Cross-site scripting XSS vulnerability in Zimbra Collaboration Suite aka ZCS before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script or HTML via vectors related to the "Show Snippet" functionality...
PT-2018-8453
Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions prior to 8.8.0 Beta2 Description A cross-site scripting issue exists, potentially allowing remote attackers to inject arbitrary web script or HTML. This is related to the "Show Snippet" functionality...
CVE-2017-8802: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Zimbra Collaboration Suite aka ZCS before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script or HTML via vectors related to the "Show Snippet" functionality...
Razer US: Authenticated DOM-based XSS in deals.razerzone.com via the rurl parameter.
The researcher discovered that deals.razerzone.com was vulnerable to Authenticated DOM-based XSS via the rurl parameter, which could allow account hijacking via session cookies. The researcher identified the specific code snippet and provided two PoCs with different techniques. Another great repo...
Open-Xchange: IDOR - Deleting other user's signature via /appsuite/api/snippet?action=update (although an error is thrown)
Hello again, I have found that everybody can delete everybody's signature via a malformed PUT request in /appsuite/api/snippet?action=update. Although a processing error is thrown, the targeted signature is deleted. POC ------------------ PUT...
WordPress Plugin Insert Html Snippet Cross-Site Request Forgery Vulnerability
WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . A cross-site request forgery vulnerability exists in Wordpress plugin Insert Html Snippet version 1.2. The...
WordPress Insert Html Snippet 1.2 Cross Site Request Forgery
------------------------------------------------------------------------ Cross-Site Request Forgery in Insert Html Snippet WordPress Plugin ------------------------------------------------------------------------ Yorick Koster, July 2016...
WordPress Insert Html Snippet 1.2 Cross Site Request Forgery Vulnerability
WordPress Insert Html Snippet plugin version 1.2 suffers from a cross site request forgery vulnerability. ------------------------------------------------------------------------ Cross-Site Request Forgery in Insert Html Snippet WordPress Plugin...
Insert Html Snippet <= 1.2 - Cross-Site Request Forgery (CSRF)
The Insert Html Snippet WordPress plugin was affected by a Cross-Site Request Forgery CSRF security vulnerability...
Brave Software: [DOS] Browser hangs on loading the code snippet
Summary: Basically the function location.reload is causing browser to hang as browser is not able to handle multiple reloads but similar issue cannot be seen in Firefox and chrome as i am able to close the current tab. Products affected: Latest brave browser in linux. Steps To Reproduce: Use the...
Brave Software: [DOS] denial of service using code snippet on brave browser
Summary: brave browser hangs due to no validation for a code snippet causing denial of service to users. Products affected: latest brave browser in linux Steps To Reproduce: code snippet:- 1 window.location+='?\u202a\uFEFF\u202b'; OR 2 window.location+='?'+window.location.toString.split'';" Note ...
krb5 security, bug fix, and enhancement update
1.14.1-26 - Use responder in non-preauth AS reqs - Resolves: 1363690 1.14.1-25 - Fix bad debuglog call in selinux handling - Resolves: 1292153 1.14.1-24 - Fix KKDCPP with TLS SNI by always presenting 'Host:' header - Resolves: 1364993 1.14.1-23 - Add dependency on libkadm5 to krb5-devel - Resolve...
