New Mac Malware Targets Cookies to Steal From Cryptocurrency Wallets

Mac users need to beware of a newly discovered piece of malware that steals their web browser cookies and credentials in an attempt to withdraw funds from their cryptocurrency exchange accounts. Dubbed CookieMiner due to its capability of stealing cookies-related to cryptocurrency exchanges, the...

Cloud Module v3.1.01 has an xss vulnerability

Cloud module is a general website management system under Nanchong Tiger Cloud Network Technology Co. Cloud Module v3.1.01 has an xss vulnerability that can be exploited by an attacker to obtain an administrator cookie...

Stored Cross-Site Scripting Vulnerability in Zendo Project Management Software z***-c***.php

Zendo Project Management Software is homegrown open source project management software. A stored cross-site scripting vulnerability exists in Zendo Project Management Software z-c.php. An attacker can insert malicious js code into the page to obtain user cookies and other information, leading to...

Cross-site Scripting Vulnerability in China Knowledge Network's TengYun Journal Co-Editing System

TengCloud periodicals collaborative editorial system mainly improves the three main functions of expense management, network debut, and multi-journal joint management, and at the same time provides several practical gadgets to improve the efficiency of the editors' work. A cross-site scripting...

Rockstar Games: DOM BASED XSS ON https://www.rockstargames.com/GTAOnline/features

In this report, the researcher identified a DOM-based Cross-Site Scripting vulnerability under the GTAOnline section of the main site. This could have left to theft of cookies if left unresolved. Interestingly, a core factor in this vulnerability was a regression of a previously identified and...

PLC Wireless Router GPN2.4P21-C-CN - Cross-Site Scripting Vulnerability

Exploit for cgi platform in category web applications Exploit Title: PLC Wireless Router GPN2.4P21-C-CN -Reflected XSS Exploit Author: Kumar Saurav Reference: https://0dayfindings.home.blog/2018/12/26/plc-wireless-router-gpn2-4p21-c-cn-reflected-xss/ Vendor: ChinaMobile Category: Hardware Version...

Rockstar Games: DOM Based xss on https://www.rockstargames.com/ ( 1 )

In this report the researcher identified a DOM-based Cross-Site Scripting vulnerability on the main rockstargames.com site. This could have been exploited to steal victim's cookies. The XSS vulnerability was discovered by combining multiple lower-severity vulns, such as directory traversal and an...

Battelle V2I Hub Cross-Site Scripting Vulnerability

The Battelle V2I Hub is a connected vehicle and roadway information management system from Battelle Memorial Institute, Inc. The system supports effective communication between infrastructure information and vehicle information. A cross-site scripting vulnerability exists in Battelle V2I Hub...

CVE-2018-1000629

Battelle V2I Hub 2.5.1 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by api/SystemConfigActions.php?action=add and the index.php script. A remote attacker could exploit this vulnerability using the parameterName or loginusername parameter in a...

Stored Cross-Site Scripting Vulnerability in Cloud Platform for Smart Government Construction

River network is a key news website in Henan Province, is agreed by the Henan Provincial Party Committee and Provincial Government, approved by the State Council Information Office, in the integration of the province's news and information resources based on the Henan newspaper network, the...

Cross Site Scripting (XSS) vulnerability in easymon

easymon version 1.4 and earlier contains a Cross Site Scripting XSS vulnerability in Endpoint where monitoring is mounted that can result in Reflected XSS that affects Firefox. Can be used to steal cookies, depending on the cookie settings.. This attack appear to be exploitable via The victim mus...

CVE-2018-1000855

CVE-2018-1000855 affects easymon version 1.4 and earlier, where an XSS weakness in the Endpoint monitoring mount allows reflected XSS via a crafted URL. The vulnerability can lead to cookie theft and is reported to affect Firefox; exploitation requires user interaction (clicking a crafted URL). T...

Shopify: Reflected XSS in *.myshopify.com/account/register

Shopify allows shop admin to enable customer registration. When a customer registers with a short password and HTML content as the first name and last name then customer redirects to .myshopify.com/account/register with error messages and the provided data. As there is no Cross-site Scripting...

IBM BigFix Platform Information Disclosure Vulnerability (CNVD-2018-26898)

IBM BigFix Platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. A security vulnerability exists in IBM BigFix Platform that originates from the program failing to set the 'HttpOnly' attribute of an authorization token or session...

ESPCMS P8 Or***.php page has xss vulnerability

ESPCMS is an enterprise website management system built on LAMP development. An xss vulnerability exists in the ESPCMS P8 Or.php page. Attackers can use this vulnerability to obtain cookie access when logging into the background as an administrator...

Oracle Secure Global Desktop Administration Console Cross-Site Scripting Vulnerability

Oracle Secure Global Desktop SGD is a desktop virtualization product from Oracle Corporation. It allows users to access server-hosted applications and desktops.Administration Console is one of the administration console programs. A cross-site scripting vulnerability exists in the helpwindow.jsp...

Stored Cross-Site Scripting Vulnerability in ThinkSAAS

ThinkSAAS is a lightweight open source community system that can be used to build discussion groups, bbs and circles. A stored cross-site scripting vulnerability exists in ThinkSAAS. An attacker can insert malicious js code into a page to obtain user cookies and other information, leading to user...

Storage-based Cross-site Scripting Vulnerability in the Website Building System of Guangdong Baicheng Talent Network Co.

Guangdong Baicheng Talent Network Co., Ltd. is an internet human resource service platform. A stored cross-site scripting vulnerability exists in the website building system of Guangdong Baicheng Talent Network Co. An attacker can insert malicious js code into the page to obtain user cookies and...

Khan Academy: Cross site scripting (content-sniffing)

Your website may be vulnerable to cross site scripting attacks HTTP request: GET...

Stored Cross-site Scripting Vulnerability in PHP7CMS Background Operation Log Function

PHP7 content management system referred to as PHP7CMS by Chunjie studio using PHP7 technology newly developed content management program. A stored cross-site scripting vulnerability exists at the operation log function in the background of PHP7CMS. Attackers can insert malicious js code in the pa...