SecNews: Text injection on error page.

An user or attacker is able to inject his text into error page and can trap to user to visit malicious sites. Even if the XSS or error custom based 404 pages error injecting is not on the scope of our program,our committee decided to disclose it publicly...

Veris: Text injection can be used in phishing 404 page and should not include attacker text

Hello i want to report a text injection and a missconfiguration of the 404 page which can be used in phishing the bug exists at : http://veris.in/test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.crowdcurity.com%20so%20go%20to%20the%20new%20one%20since%20this%20one As you ca...

LocalTapiola: Content Spoofing or Text Injection (404 error page injection on yrityspalvelu)

Vulnerability Description: Application allows users to inject any content on the 404 not found webpage Vulnerable Location: https://yrityspalvelu.tapiola.fi/a1/has%20been%20changed%20by%20a%20new%20one%20https://www.attacker.com%20so%20go%20to%20the%20new%20one%20since%20this%20one Fix : just use...

Vimeo: Error page Text Injection.

Error page text injection...

Trello: Error Page Text Injection.

AS we can see in report an user or attacker is able to inject his text into error page and can trap to user to visit other site by adding following link /test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.malicious.com%20so%20go%20to%20the%20new%20one%20since%20this%20one A...

Gratipay: text injection in website title

Hi, I would like to report an incomplete fix of 115284 , text can inject in website title , see attached files. Regards...

Uber: text injection in get.uber.com/check-otp

Text Injection no HTML or JS in a landing page on get.uber.com...

ownCloud: owncloud.help: Text Injection

Hello i want to report a text injection and a missconfiguration of the 404 page which can be used in phishing Text injection can be used in phishing 404 page should not include attacker text The bug exists at :...

withinsecurity: text injection can be used in phishing 404 page should not include attacker text

Hello i want to report a text injection and a missconfiguration of the 404 page which can be used in phishing the bug exists at : https://withinsecurity.com/test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.crowdcurity.com%20so%20go%20to%20the%20new%20one%20since%20this%20on...

Algolia: text injection can be used in phishing 404 page should not include attacker text

Hello i want to report a text injection and a missconfiguration of the 404 page which can be used in phishing the bug exists at : https://www.algolia.com/test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.crowdcurity.com%20so%20go%20to%20the%20new%20one%20since%20this%20one...

Content Spoofing in AppPortalPage

A third party scan found that the ConvertIssue.jspa action is vulnerable to content spoofing, in specific text injection. In this case the content spoofing may be used to perform a phishing attack on users. How to reproduce:...

Content Spoofing in AppPortalPage

A third party scan found that the ConvertIssue.jspa action is vulnerable to content spoofing, in specific text injection. In this case the content spoofing may be used to perform a phishing attack on users. How to reproduce:...

Content Spoofing in AppPortalPage

A third party scan found that the ConvertIssue.jspa action is vulnerable to content spoofing, in specific text injection. In this case the content spoofing may be used to perform a phishing attack on users. How to reproduce:...

Multiple HTML Injection Vulnerabilities in Dolibarr

Dolibarr is a WEB-based open source ERP and CRM system . Dolibarr suffers from multiple HTML injection vulnerabilities due to the program failing to adequately filter user-submitted input. The vulnerabilities could be exploited to allow an attacker to execute arbitrary script code in the context ...

Content Spoofing in the createrssfeed action

A third party scan found that createrssfeed action is vulnerable to content spoofing|https://www.owasp.org/index.php/ContentSpoofing, in specific text injection. In this case the content spoofing may be used to perform a phishing attack on users. How to reproduce: 1. go to...

Content Spoofing in the ConvertIssue.jspa action

A third party scan found that the ConvertIssue.jspa action is vulnerable to content spoofing|https://www.owasp.org/index.php/ContentSpoofing, in specific text injection. In this case the content spoofing may be used to perform a phishing attack on users. How to reproduce: 1. go to...

Content Spoofing in the ConvertIssue.jspa action

A third party scan found that the ConvertIssue.jspa action is vulnerable to content spoofing|https://www.owasp.org/index.php/ContentSpoofing, in specific text injection. In this case the content spoofing may be used to perform a phishing attack on users. How to reproduce: 1. go to...

CVE-2013-4098

ServerAdmin/ErrorViewer.jsp in DS3 Authentication Server allow remote attackers to inject arbitrary error-page text via the message parameter...

CGI Generic Tests Load Estimation (quick tests, text injection)

This script computes the maximum number of requests that would be done by the generic web tests, depending on miscellaneous options. It does not perform any test by itself. It adjusts the mode of each script if it is unable to run in the given time. The results can be used to estimate the duratio...

Claroline 1.8.11 Cross Site Scripting

Author: Gerendi Sandor Attila Original Advisory: http://gsasec.blogspot.com/2009/05/claroline-v1811-cross-site-scripting.html Date: May 05, 2009 Package: Claroline 1.8.11 Product Homepage: http://www.claroline.net/ Versions Affected: v.1.8.11 Other versions may also be affected Severity: Medium...