198 matches found
WP Meta SEO < 4.4.7 - Admin+ Stored Cross-Site Scripting via breadcrumbs
The plugin does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html is disallowed. As admin, put the following payload in the Breadcrumb...
WP Meta SEO < 4.4.7 - Admin+ Stored Cross-Site Scripting via breadcrumbs
The plugin does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html is disallowed. PoC As admin, put the following payload in the Breadcrumb...
DRUPAL-CONTRIB-2022-024
The Custom Breadcrumbs module provides a variety of options for customizing the breadcrumb trail. The module doesn't sufficiently filter on output, leading to a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission...
Custom Breadcrumbs - Less critical - Cross Site Scripting - SA-CONTRIB-2022-024
The Custom Breadcrumbs module provides a variety of options for customizing the breadcrumb trail. The module doesn't sufficiently filter on output, leading to a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission...
CVE-2020-15221 XSS in the breadcrumbs
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, by modifying target browser local storage, an XSS can be generated in the iTop console breadcrumb. This is fixed in versions 2.7.2 and 3.0.0...
Joomla! cross-site scripting vulnerability (CNVD-2021-02804)
Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site scripting vulnerability exists in Joomla! 3.9.0 - 3.9.23. The...
CVE-2021-23124
An issue was discovered in Joomla! 3.9.0 through 3.9.23. The lack of escaping in modbreadcrumbs aria-label attribute allows XSS attacks...
Open Source Matters Joomla 跨站脚本漏洞
Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site scripting vulnerability exists in Joomla! 3.9.0 - 3.9.23. The...
PT-2021-15379 · Joomla · Joomla!
Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.9.0 through 3.9.23 Description: The issue is related to a lack of escaping in the aria-label attribute of the mod breadcrumbs module, which allows XSS attacks. Recommendations: For Joomla! versions 3.9.0 through 3.9.23,...
Identifying a Person Based on a Photo, LinkedIn and Etsy Profiles, and Other Internet Bread Crumbs
Interesting story of how the police can identify someone by following the evidence chain from website to website. According to filings in Blumenthal's case, FBI agents had little more to go on when they started their investigation than the news helicopter footage of the woman setting the police c...
Getting Insights into the Delivery Path of Media with Breadcrumbs
Problem Definition Media streaming typically involves three main components: a player, the origin, and a CDN. Typically, the content provider owns the player and the origin stack and hence is able to diagnose and troubleshoot issues, but the CDN for the most part is a black box. The player...
CVE-2012-1169
Moodle before 2.2.2 has Personal information disclosure, when administrative setting users name display is set to first name only full names are shown in page breadcrumbs...
CVE-2012-1169: Exposure of Sensitive Information to an Unauthorized Actor
Moodle before 2.2.2 has Personal information disclosure, when administrative setting users name display is set to first name only full names are shown in page breadcrumbs...
GHSA-RWPR-83G3-96G7 Cross-site scripting in padrino-contrib
The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption...
Cross-site scripting in padrino-contrib
The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption...
padrino-contrib XSS via caption parameter of breadcrumbs helper
The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption...
CVE-2019-16145
The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption...
CVE-2019-16145
The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption...
CVE-2019-16145
CVE-2019-16145 affects the padrino-contrib breadcrumbs module (up to version 0.2.0) used with Padrino Framework. The root cause is an XSS in the caption parameter of breadcrumbs.rb that is not properly escaped, allowing script injection. This can enable an attacker to steal session tokens or perf...