2005 matches found
Imgur: Reflected XSS in m.imgur.com
There is a reflected XSS vulnerability in https://m.imgur.com as shown below: https://m.imgur.com/account/testcatplzignore%22%3E%3Cimg%20src=x%20onerror=promptdocument.domain%3E/messages It appears that the username field in the url does not sanitize angle bracket characters on the mobile version...
Radancy: Application error message
Attack details HTTP Header input X-Forwarded-For was set to 12345'"'";|%00%0d%0a%bf%27'??? Error message found: Warning: inetpton function.inet-pton: Unrecognized address 12345'"\'\";|%00%0d%0a%00%bf%27' in...
Firefox Security Toolkit - A Tool that Transforms Firefox Browsers into a Penetration Testing Suite
A tool that transforms Firefox Browsers into a penetration testing suite How? It downloads the most important extensions, and install it on your browser. The used extensions has been chosen by a survey among the information security community. Based on it's results, Firefox Security Toolkit was...
Firefox Security Toolkit
Firefox Security Toolkit will download the most important security extensions and add them all into your browser. All the extensions have been chosen by a survey among the information security community. Based on the results, the Firefox Security Toolkit was made. Also, the Firefox Security Toolk...
Uber: Uber is Flooding my Mobile with SMS Daily like a cron JOB
The Issue is with the design of sending SMS by the uber referrals system, and every day it's flodding my phone number with driver invitaion message To reproduce this scenario i have Fuzz the below request Through OWSAP Zap I fuzzed for 10,000 requests , keep the same Phone number I have used my...
Download Wayback Machine Archive: waybackpack
Download Wayback Machine archive for a given URL Waybackpack is a command-line tool that lets you download the entire Wayback Machine archive for a given URL. Waypackback is written in pure Python, depends only on requests , and should work wherever Python works. Should be compatible with both...
Vimeo: Images and Subtitles Leakage from private videos
Hello, There is a Vulnerability in https://player.vimeo.com/video/VIDEOID When a Video is private but embedable, there are some information about the video on the source code of the webpage, even if the user is not connected to Vimeo or doesn't have right to access the video. The following info a...
Whitewidow - SQL Vulnerability Scanner
Whitewidow is an open source automated SQL vulnerability scanner, that is capable of running through a file list, or can scrape Google for potential vulnerable websites. It allows automatic file formatting, random user agents, IP addresses, server information, multiple SQL injection syntax, and a...
IPGeoLocation - A tool to retrieve IP Geolocation information
A tool to retrieve IP Geolocation information Powered by ip-api Requirements Python 3.x Features Retrieve IP or Domain Geolocation. Retrieve your own IP Geolocation. Retrieve Geolocation for IPs or Domains loaded from file. Each target in new line. Define your own custom User Agent string. Select...
OpenWGA Content Manager 7.1.9 User-Agent HTTP Header XSS
OpenWGA Content Manager 7.1.9 User-Agent HTTP Header XSS Vulnerability Vendor: Innovation Gate GmbH Product web page: https://www.openwga.com Affected version: OpenWGA Content Manager 7.1.9 Build 230 OpenWGA Admin Client 7.1.7 Build 82 OpenWGA Server 7.1.9 Maintenance Release Build 642 Summary:...
OpenWGA Content Manager 7.1.9 User-Agent HTTP Header XSS Vulnerability
Summary OpenWGA is an advanced open source java based enterprise CMS platform featuring real WYSIWYG, a state of the art CMS IDE and more. Description OpenWGA suffers from a cross-site scripting vulnerability when input passed via the User-Agent HTTP header is not properly sanitized before being...
CVE-2015-0265
Cross-site scripting XSS vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary web script or HTML via the HTTP User-Agent header...
Cross site scripting
Cross-site scripting XSS vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary web script or HTML via the HTTP User-Agent header...
CVE-2015-0265
Cross-site scripting XSS vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary web script or HTML via the HTTP User-Agent header...
Snapchat: XSS found on Snapchat website
Hi Snapchat Team, I've found a reflected XSS vulnerability on this page: https://www.snapchat.com/add/snapchat Example: https://www.snapchat.com/add/%22%3E%3Ch1%3EXSS%3C%2Fh1%3E Note: you should visit the page with a mobile user-agent since the server displays different information based on the...
CVE-2016-1643
The ImageInputType::ensurePrimaryContent function in WebKit/Source/core/html/forms/ImageInputType.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly maintain the user agent shadow DOM, which allows remote attackers to cause a denial of service or possibly have unspecifi...
Type confusion
The ImageInputType::ensurePrimaryContent function in WebKit/Source/core/html/forms/ImageInputType.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly maintain the user agent shadow DOM, which allows remote attackers to cause a denial of service or possibly have unspecifi...
CVE-2016-1643
The ImageInputType::ensurePrimaryContent function in WebKit/Source/core/html/forms/ImageInputType.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly maintain the user agent shadow DOM, which allows remote attackers to cause a denial of service or possibly have unspecifi...
ATSCAN v6.2 - Search / Site / Server Scanner
Description: SEARCH engine XSS scanner. Sqlmap. LFI scanner. Filter wordpress and Joomla sites in the server. Find Admin page. Decode / Encode MD5 + Base64. Ports scan. Scan E-mails in sites. Use proxy. Random user agent. Fandom search engine. Scan errors. Detect Cms. Multiple instant scan...
