DataLife Engine 11.1 Cross Site Scripting

... ========================== - Discovered By : 0x3a - http://iran-cyber.net - tahadot0x3aatgmaildotcom - Credit To Iran Cyber Security Group - Release Date : 10.8.2016 - Level : High ========================== I.Vulnerability --------------- DataLife Engine 11.1 process $POST'title' ; They used...

netgarn.dk XSS vulnerability

Vulnerable URL: http://netgarn.dk/default.asp?lang=uk" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 3235844 VIP website status:| No Check netgarn.dk SSL connection:| Grade: F...

Snapchat: [render.bitstrips.com] Stored XSS via an incorrect avatar property value

While modifying an avatar, an attacker has the opportunity to submit XSS payloads as its property values. The resulting png file will return a 500 error with the payload in the response body. The response has a text/html content type, which makes the XSS attack possible. PoC: 1. Go to...

LocalTapiola: Blind Stored XSS Against Lahitapiola Employees - Session and Information leakage

Hi, I am pretty sure that I found a vulnerability similar to https://hackerone.com/reports/135154. An adversary can use the "Lähetä viesti"-functionality of the LähiTapiola Asiakassalkku to send a malicious file. When the customer service opens the file, an XSS will execute and will leak user IP...

checkurl.info XSS vulnerability

Vulnerable URL: http://www.checkurl.info/whois.php?query=" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5079503 VIP website status:| No Check checkurl.info SSL connection:| Grade...

ceaq-sorbonne.org XSS vulnerability

Vulnerable URL: http://www.ceaq-sorbonne.org/node.php?clef=recherche%5Btables%5D%5Bitem%5D=TRUE%5Btables%5D%5Belement%5D=TRUE%5Blangue%5D%5B3%5D=TRUE%5Bstring%5D=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28%2FOPENBUGBOUNTY%2F%29%3E%3C%22 Details: Description| Value ---|--- Patched:| No Latest check f...

bertsoa.eus XSS vulnerability

Vulnerable URL: http://www.bertsoa.eus/eu/bertsoa-bertsolariak-ficha.asp?id=36" Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 23:09 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 6245584 VIP website status:...

Moodle 2.0.x < 2.0.10 Multiple Vulnerabilities

Binary data 9403.prm...

Uber: newsroom.uber.com is vulnerable to 'SOME' XSS attack via plupload.flash.swf

Limited disclosure @jamesclyde's request...

guiltyfix.com XSS vulnerability

Vulnerable URL: http://guiltyfix.com/?s=alert"OPENBUGBOUNTY"...

WordPress Plugin Real3D FlipBook - Multiple Vulnerabilities

POCExploit CodeCanyon Real3D FlipBook WordPress Plugin + http://codecanyon.net/item/real3d-flipbook-wordpress-plugin/6942587 + Multiple Vulnerabilities Found by: Mukarram Khalid + https://mukarramkhalid.com/wordpress-real-3d-flipbook-plugin-exploit/ + Requirements : Python 3.4.x or higher,...

espace.ae XSS vulnerability

Vulnerable URL:...

newgamesbox.net XSS vulnerability

Vulnerable URL: http://www.newgamesbox.net/search.php?searchString=%22%27%2F%3E%3B%3C%2Fstyle%3E%3Cscript%3Ea%3Deval%3Bb%3Dalert%3Ba%28b%28%2F+XSSPOSED%2F.source%29%29%3B%3C%2Fscript%3E%27%22%3E=Search Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:|...

kehillatshalom.org XSS vulnerability

Vulnerable URL: http://www.kehillatshalom.org/payment.php?notes=%3C/stYle/%3C/titLe/%3C/teXtarEa/%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 22496390 VIP...

XSS through FPD

PMASA-2016-24 Announcement-ID: PMASA-2016-24 Date: 2016-06-23 Summary XSS through FPD Description With a specially crafted request, it is possible to trigger an XSS attack through the example OpenID authentication script. Severity We do not consider this vulnerability to be secure due to the...

Cisco Firepower Management Center Persistent Cross-Site Scripting Vulnerability

A vulnerability in the HTTP framework of Cisco Firepower Management Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against an affected device. The vulnerability is due to insufficient filtering of output data. An attacker could exploit this...

KLA10829 Multiple vulnerabilities in Microsoft Edge and Internet Explorer

Multiple serious vulnerabilities have been found in Microsoft Edge. Malicious users can exploit these vulnerabilities to bypass security restrictions, perform privilege escalation, execute arbitrary code or obtain sensitive information. Below is a complete list of vulnerabilities 1. An improper...

branchenzentraleintrag.org XSS vulnerability

Vulnerable URL: http://branchenzentraleintrag.org/index.php?femail=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

babadu.ru XSS vulnerability

Open Bug Bounty ID: OBB-152401 Description| Value ---|--- Affected Website:| babadu.ru Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

shop.usana.com XSS vulnerability

Vulnerable URL: https://shop.usana.com/shop/jsp/shop/MxZipCodeLookup.jsp?pgAction=mxlookup=%22%3E%3Cimg%20src=x%20onerror=prompt%28/OPENBUGBOUNTY/%29%3E=MX=shippingAndPaymentInfo=shippingInfopostalCode&street3Field;=shippingInfoaddress3=shippingInfocity=shippingInfostateCode Details: Description|...