Cross site scripting

The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS...

CVE-2018-10309

The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS...

CVE-2018-10309

The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS...

CVE-2018-10309

The CVE-2018-10309 entry describes an XSS in the WordPress plugin Responsive Cookie Consent prior to version 1.8. Concrete details from connected sources show the vulnerability stems from mishandling numeric fields, allowing injected HTML/Script to execute in a victim’s browser when visiting the ...

WordPress UK Cookie Consent 2.3.9 Cross Site Scripting

Exploit Title: UK Cookie Consent v2.3.9 - Persistent Cross-Site Scripting Date: 2018-04-22 Exploit Author: B0UG Vendor Homepage: https://catapultthemes.com/ Software Link: https://en-gb.wordpress.org/plugins/uk-cookie-consent/description Version: Tested on version 2.3.9 older versions may also be...

UK Cookie Consent <= 2.3.9 - Authenticated Stored Cross-Site Scripting (XSS)

A persistent cross-site scripting vulnerability has been identified in the web interface of the plugin that allows the execution of arbitrary HTML/script code to be executed in a victim's web browser. Tested on version 2.3.9 older versions may also be affected 1 Access WordPress control panel. 2...

UK Cookie Consent <= 2.3.9 - Authenticated Stored Cross-Site Scripting (XSS)

A persistent cross-site scripting vulnerability has been identified in the web interface of the plugin that allows the execution of arbitrary HTML/script code to be executed in a victim's web browser. Tested on version 2.3.9 older versions may also be affected PoC 1 Access WordPress control panel...

WordPress UK Cookie Consent - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: UK Cookie Consent v2.3.9 - Persistent Cross-Site Scripting Exploit Author: B0UG Vendor Homepage: https://catapultthemes.com/ Software Link: https://en-gb.wordpress.org/plugins/uk-cookie-consent/description Version: Tested on...

UK Cookie Consent - Persistent Cross-Site Scripting

Exploit Title: UK Cookie Consent v2.3.9 - Persistent Cross-Site Scripting Date: 2018-04-22 Exploit Author: B0UG Vendor Homepage: https://catapultthemes.com/ Software Link: https://en-gb.wordpress.org/plugins/uk-cookie-consent/description Version: Tested on version 2.3.9 older versions may also be...

CVE-2018-6109

readAsText can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to access data on the user file system without explicit consent via a crafted HTML page...

Facebook and Cambridge Analytica

In the wake of the Cambridge Analytica scandal, news articles and commentators have focused on what Facebook knows about us. A lot, it turns out. It collects data from our posts, our likes, our photos, things we type and delete without posting, and things we do while not on Facebook and even when...

Experts Call Facebook’s Latest Controversy a Social Media ‘Breach Of Trust’

Privacy advocates are calling on all social media platforms to more responsibly handle and restrict improper access to data in the wake of Facebook’s latest controversy where it acknowledged users’ personal information had leaked through a third-party app. “People are shocked this happened, but I...

CVE-2017-7419 NetIQ Access Manager OAuth Consent screen XSS attack

A OAuth application in NetIQ Access Manager 4.3 before 4.3.2 and 4.2 before 4.2.4 allowed cross site scripting attacks due to unescaped "description" field that could be specified by the provider...

Doorkeeper gem has stored XSS on authorization consent view

Stored XSS on the OAuth Client's name will cause users being prompted for consent via the "implicit" grant type to execute the XSS payload. The XSS attack could gain access to the user's active session, resulting in account compromise. Any user is susceptible if they click the authorization link...

UBUNTU-CVE-2017-18121

The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft links that could execute arbitrary JavaScript code on the victim's web browser...

Session Fixation

github.com/ory/hydra is vulnerable to session fixation attacks. A malicious user can pass a consent uri missing a CSRF token to the user and log in afterwards as that user through a callback url...

OnePlus Confirms Credit Card Breach Impacted Up to 40,000 Customers

OnePlus has confirmed that up to 40,000 customers have been affected by a credit card breach, in the latest embarrassing misstep for the Chinese handset maker. The news comes several days after OnePlus shut down credit card processing following complaints from customers about fraudulent charges...

CVE-2017-6679

The Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted remote support tunnel SSH which auto initiated from the customer's appliance to Cisco's SSH Hubs in the Umbrella datacenters. These tunnels were primarily leveraged for remote support and allowed for...

Hundreds Of websites mining cryptocurrency without user consent

By Waqas Previously it was reported that torrent search platform The Pirate This is a post from HackRead.com Read the original post: Hundreds Of websites mining cryptocurrency without user consent...

Microsoft Outlook Information Disclosure Vulnerability

An information disclosure vulnerability exists when Microsoft Outlook fails to properly validate authentication requests. To exploit the vulnerability an attacker would have to trick a user into browsing to a malicious website or to an SMB or UNC path destination. Alternatively the attacker could...