Gratipay: x-xss protection header is not set in response header

URL : http://inside.gratipay.com/ Description : This header enables the Cross-site scripting XSS filter built into most recent web browsers. It's usually enabled by default anyway, so the role of this header is to re-enable the filter for this particular website if it was disabled by the user. Th...

Amazon AWS XSS Protection Bypass

Exploit Author: Ajay Gowtham Vendor: ========================== http://aws.amazon.com/ Amazon Web Services, is a subsidiary of Amazon.com, which offers a suite of cloud computing services that make up an on-demand computing platform. These services operate from 12 geographical regions across the...

phpMyFAQ 2.9.0 - Persistent Cross-Site Scripting

phpMyFAQ 2.9.0 - Persistent Cross-Site Scripting Exploit Title: phpMyFAQ 2.9.0 Stored XSS Date: 09-06-2016 Software Link: http://www.phpmyfaq.de/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description PHP...

Cisco IP Interoperability and Collaboration System Cross-Site Scripting Vulnerability

A vulnerability in the web framework code of Cisco IP Interoperability and Collaboration System could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerability is due to insufficient XSS protections. An attacker could exploit this vulnerability by...

ownCloud: doc.owncloud.org: X-XSS-Protection not enabled

X-Xss-Protection @https://doc.owncloud.org/ has not been set. This header is used to configure the built in reflective XSS protection found in Internet Explorer, Chrome and Safari Webkit. Valid settings for the header are 0, which disables the protection, 1 which enables the protection and 1;...

As an administrator I want to be able to configure whether XSS protection should apply to requirements or not

h3. Problem Definition For XSS protection, certain "dangerous" characters are not allowed for input in many fields in Bamboo, including for requirements. One such character is the ampersand &, which can be used for logical AND expressions such as "a && b" for "a AND b". At the moment, because XSS...

Cross site scripting

Cisco Unified Communications Manager UCM 8.0 through 8.6 allows remote attackers to bypass an XSS protection mechanism via a crafted parameter, aka Bug ID CSCuu15266...

PT-2015-6456

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager UCM versions 8.0 through 8.6 Description The issue allows remote attackers to bypass an XSS protection mechanism via a crafted parameter. Recommendations For versions 8.0 through 8.6, update to a version th...

Cross site scripting

Microsoft Internet Explorer 8 through 11 and Microsoft Edge mishandle HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting XSS protection mechanism via unspecified vectors, aka "Microsoft Browser XSS Filter Bypass Vulnerability."...

Cross site scripting

Microsoft Internet Explorer 8 through 11 mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting XSS protection mechanism via unspecified vectors, aka "Internet Explorer XSS Filter Bypass Vulnerability."...

PT-2015-2991

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 8 through 11 Description The issue is caused by errors in handling HTTP response attributes, which allows remote attackers to bypass a cross-site scripting XSS protection mechanism. This could lead to...

Radancy: XSS risk reduction with X-XSS-Protection: 1; mode=block header

As you can read for example on this Microsoft blog http://blogs.msdn.com/b/ieinternals/archive/2011/01/31/controlling-the-internet-explorer-xss-filter-with-the-x-xss-protection-http-header.aspx: " ... X-XSS-Protection: 1; mode=block When this token is present, if a potential XSS Reflection attack...

CVE-2015-6058: Improper Neutralization of Input During Web Page Generation

Microsoft Edge mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting XSS protection mechanism via unspecified vectors, aka "Microsoft Edge XSS Filter Bypass."...

Gratipay: Self XSS Protection not used , I can trick users to insert JavaScript

Self XSS Protection not used , I can trick users to insert JavaScript I see that you have not enabled "Self XSS Protection not used" on gratipay.com This technique prevents user from getting tricked into injecting js themselves For example, Facebook have :...

WordPress Yet Another Related Posts 4.2.4 CSRF / XSS / Code Execution

Homepage https://wordpress.org/plugins/yet-another-related-posts-plugin/ Affected Versions input type='hidden' name='autodisplaypostt...

Block.io: Various Low level Vulnerabilities

1.XSS protection Not Enabled: Example URL: https://block.io/js/secure/secrets.js?mtime=1412493238 Web Browser XSS Protection is not enabled, or is disabled by the configuration of the 'X-XSS-Protection' HTTP response header on the web server The X-XSS-Protection HTTP response header allows the we...

Tccms sql注入获得管理账号密码

简要描述： 直接看到/app/model/attackAction.class.php这个文件 public function initLogHacker /get/ foreach$GET as $key=$value if !inarray$key, array'ac','a','c','do'//防止控制器和方法命名不规范被过滤 $this-StopAttack$key,$value,"get",$this-getfilter; $GET$key = StringUtil::safereplace$value; $GET$key =...

CVE-2014-2966

The ISO-8859-1 encoder in Resin Pro before 4.0.40 does not properly perform Unicode transformations, which allows remote attackers to bypass intended text restrictions via crafted characters, as demonstrated by bypassing an XSS protection mechanism...

Design/Logic Flaw

The ISO-8859-1 encoder in Resin Pro before 4.0.40 does not properly perform Unicode transformations, which allows remote attackers to bypass intended text restrictions via crafted characters, as demonstrated by bypassing an XSS protection mechanism...

CVE-2014-2966

The ISO-8859-1 encoder in Resin Pro before 4.0.40 does not properly perform Unicode transformations, which allows remote attackers to bypass intended text restrictions via crafted characters, as demonstrated by bypassing an XSS protection mechanism...