123 matches found
GHSA-Q4QQ-FM7Q-CWP5 Multiple XSS Filter Bypasses in validator
Versions of validator prior to 1.1.0 are affected by several cross-site scripting vulnerabilities due to bypasses discovered in the blacklist-based filter. Proof of Concept Various inputs that could bypass the filter were discovered: Improper parsing of nested tags: This is a test Incomplete...
GHSA-552W-RQG8-GXXM Moderate severity vulnerability that affects validator
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting XSS filter via vectors related to UI redressing...
Shopify: Stored XSS in partners dashboard
Hello Stored XSS and UI redressing on https://partners.shopify.com/partnerID/confirm. PoC: 1.Change your First Name and Last Name with XSS payload on https://accounts.shopify.com/account 2.Create an account on https://partners.shopify.com/ or if you have an account on...
APSB17-22 Security update available for Adobe Connect
Adobe has released a security update for Adobe Connect for Windows. This update resolves two input validation vulnerabilities CVE-2017-3102, CVE-2017-3103 that could be used in reflected and stored cross-site scripting attacks, respectively. This update also includes a mitigation to protect users...
CVE-2013-7453
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting XSS filter via vectors related to UI redressing...
UBUNTU-CVE-2013-7453
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting XSS filter via vectors related to UI redressing...
CVE-2013-7453
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting XSS filter via vectors related to UI redressing...
CVE-2013-7453
CVE-2013-7453 affects the validator module for Node.js prior to version 1.1.0. The vulnerability allows remote attackers to bypass the cross-site scripting (XSS) filter through vectors related to UI redressing, enabling potential bypass of input-filtering protections. Documented impact is limited...
CVE-2013-7453
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting XSS filter via vectors related to UI redressing...
CVE-2013-7453
Removed by vendor...
CVE-2013-7453: Improper Neutralization of Input During Web Page Generation
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting XSS filter via vectors related to UI redressing...
QIWI: [ibank.qiwi.ru] UI Redressing via Request-URI
Website ibank.qiwi.ru was vulnerable to UI redressing through one of the headers...
Snapchat: XSS found on Snapchat website
Hi Snapchat Team, I've found a reflected XSS vulnerability on this page: https://www.snapchat.com/add/snapchat Example: https://www.snapchat.com/add/%22%3E%3Ch1%3EXSS%3C%2Fh1%3E Note: you should visit the page with a mobile user-agent since the server displays different information based on the...
PT-2017-5759
Name of the Vulnerable Software and Affected Versions: validator module versions prior to 1.1.0 Description: The issue allows remote attackers to bypass the cross-site scripting XSS filter. This is achieved via vectors related to UI redressing, which is a technique used to trick users into...
PT-2017-5760
Name of the Vulnerable Software and Affected Versions: validator versions prior to 1.1.0 Description: The issue allows remote attackers to bypass the cross-site scripting XSS filter via nested forbidden strings. Several cross-site scripting vulnerabilities are present due to bypasses discovered i...
Multiple XSS Filter Bypasses
Overview Versions of validator prior to 1.1.0 are affected by several cross-site scripting vulnerabilities due to bypasses discovered in the denylist-based filter. Proof of Concept Various inputs that could bypass the filter were discovered: Improper parsing of nested tags: This is a test...
Coinbase: OAUTH pemission set as true= lead to authorize malicious application
OAuth authorize button in the Coinbase Android App did not have the android:filterTouchesWhenObscured attribute set to true, which may have made it vulnerable to tap-jacking. Reported UI Redressing Clickjacking For Mobile application of Coinbase , attack scenario is same as...
ZTE 831CII Multiple Vulnerablities
Exploit for hardware platform in category web applications Exploit Title: ZTE 831CII Multiple Vulnerablities Date: 11/3/2014 Exploit Author: Paulos Yibelo Vendor Homepage: zte.com.cn Software Link: - Version: - Tested on: Windows 7 CVE :- Hardcoded default misconfiguration - The modem comes with...
ZTE 831CII Multiple Vulnerablities
Hardcoded default misconfiguration - The modem comes with admin:admin user credintials. Stored XSS - http://192.168.1.1/psilan.cgi?action=saveðIpAddress=192.168.1.1ðSubnetMask=255.255.255.0&hostname=ZXDSL83C1II&domainname=home27;alert28029;//&enblUpnp=1&enblLan2=0 Any user browsing to...
ZTE 831CII Hardcoded Credential / XSS / CSRF
Hardcoded default misconfiguration - The modem comes with admin:admin user credintials. Stored XSS - http://192.168.1.1/psilan.cgi?action=saveðIpAddress=192.168.1.1ðSubnetMask=255.255.255.0&hostname=ZXDSL83C1II&domainname=home%27;alert%280%29;//&enblUpnp=1&enblLan2=0 Any user browsing to...