Cookiethief: a cookie-stealing Trojan for Android

We recently discovered a new strain of Android malware. The Trojan detected as: Trojan-Spy.AndroidOS.Cookiethief turned out to be quite simple. Its main task was to acquire root rights on the victim device, and transfer cookies used by the browser and Facebook app to the cybercriminals' server...

XSS Vulnerability in WisdomTooth's Manual Online Customer Service Chat Service

Beijing Wisdom Tooth Bochuang Technology Co., Ltd. is a provider of intelligent full customer service platform. A cross-site scripting vulnerability exists in WisdomTooth's manual online customer service chat. An attacker can insert malicious js code into the page to obtain user cookies and other...

CVE-2020-4082

The HCL Connections 5.5 help system is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting...

CVE-2019-19134

The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript within the browser of ...

Input validation

The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript within the browser of ...

Stored Cross-site Scripting Vulnerability in the Merchant Center Function of Farming Building Station Mall-based System

Farming Builders is a new generation of SaaS cloud intelligent website building tools. A stored cross-site scripting vulnerability exists in the Merchant Center feature of the Farming Station mall-based system. Attackers can use the vulnerability to insert malicious js code to obtain user cookies...

Stored Cross-Site Scripting Vulnerability in HFish Honeypots

HFish honeypot is an extended enterprise security testing active induction open source honeypot framework system. HFish honeypot has a stored cross-site scripting vulnerability. Attackers can insert malicious js code in the page to obtain user cookies and other information , resulting in user...

Razer: Reflected XSS on molpay.com with cloudflare bypass

The tester discovered a reflected XSS vulnerability on molpay.com which could allow an adversary to steal client side information such as a cookie. Razer Fintech thanks the tester for his clear report and PoC. Follow brutelogic for amazing bypass tips. Thank you for bounty @razer 🙏...

XSS Vulnerability in FoosunCMS

FoosunCMS content management system FoosunCMS is a content management software based on ASP + ACCESS/MSSQ framework, a domestic open source, integrated web2.0 elements, modular CMS station-building system. FoosunCMS has a stored cross-site scripting vulnerability. Attackers can insert malicious j...

Stored Cross-Site Scripting Vulnerability in LJCMS (CNVD-2020-18758)

LJCMS is a free and open source content management system. A stored cross-site scripting vulnerability exists in LJCMS. An attacker can insert malicious js code into a page to obtain user cookies and other information, leading to user hijacking...

Rockstar Games: Dom based XSS on www.rockstargames.com/GTAOnline/features/freemode

In this report, the researcher identified a DOM-Based XSS vulnerability on www.rockstargames.com/GTAOnline/features/freemode. This type of attack can result in cookie theft, or enable CSRF and phishing attacks. With the researcher's help we were able to identify the cause of the vulnerability and...

Stored Cross-site Scripting Vulnerability in Qibo CMS System

Qibo CMS system is a content management system under Guangzhou Qibo Network Technology Co. A stored cross-site scripting vulnerability exists in the Qibo CMS system. An attacker can insert malicious js code into a page to obtain user cookies and other information, leading to user hijacking...

XSS vulnerability in the re***.php file of the VIP movie system of Tuan ah (CNVD-2020-15537)

Tuan ah VIP movie system is a set of VIP movie video viewing website with registered member agent version. A XSS vulnerability exists in the re.php file of Tuan Ah VIP Movie System. An attacker can insert malicious js code into the page to obtain user cookies and other information, resulting in...

XSS vulnerability in the re***.php file of the VIP movie system of Tuan ah (CNVD-2020-15538)

Tuan ah VIP movie system is a set of VIP movie video viewing website with registered member agent version. A stored cross-site scripting vulnerability exists in the re.php file of the Tuan Ah VIP Movie System. An attacker can insert malicious js code into the page to obtain user cookies and other...

CVE-2020-7050

Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cooki...

CVE-2020-7050

Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cooki...

Design/Logic Flaw

Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cooki...

Stored Cross-site Scripting Vulnerability in Tuan Ah VIP Movie System re***.php File

Tuan ah VIP movie system is a set of VIP movie video viewing website with registered member agent version. A stored cross-site scripting vulnerability exists in the re.php file of the Tuan Ah VIP Movie System. An attacker can insert malicious js code into the page to obtain user cookies and other...

Topcoder: Cross Site Scripting via CVE-2018-5230 on https://apps.topcoder.com

Hi, I found reflected xss on https://apps.topcoder.com via error message.. Payload : %3CIFRAME%20SRC%3D%22javascript%3Aalert%28%27XSS%27%29%22%3E.vm Vulnerable link : https://apps.topcoder.com/wiki/labels/%3CIFRAME%20SRC%3D%22javascript%3Aalert'XSS'%22%3E.vm Step to reproduce : Create an account...

jenkins: Diagnostic web page exposed Cookie HTTP header

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly...