167 matches found
CVE-2018-19644
CVE-2018-19644 affects Micro Focus Solutions Business Manager (SBM, formerly Serena SBM) and SBM versions prior to 11.5. The connected documents describe a reflected cross-site scripting vulnerability that allows a remote attacker to inject arbitrary web script or HTML into SBM’s web context.
Cross-Site Script Inclusion (XSSI)
Jupyter notebook is vulnerable to cross-site script inclusion XSSI. When a user is logged into the Jupyter server and visits an unauthorized website, the web resources from a known URL could be included in a page of that unauthorized website, causing malicious code to be executed in the victim's...
Embed Video Scripts - Persistent Cross-Site Scripting
Embed Video Scripts - Persistent Cross-Site Scripting Exploit Title: Embed Video Scripts - Cross-site Script stored Google Dork: N/A Date: 1 Jan 2019 Exploit Author: Deyaa Muhammad Author EMail: contact at deyaa.me Author Blog: http://deyaa.me POC Video: https://youtu.be/2CFJLwkxpT8 Vendor...
Embed Video Scripts - Persistent Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: Embed Video Scripts - Cross-site Script stored Exploit Author: Deyaa Muhammad Author EMail: contact at deyaa.me Author Blog: http://deyaa.me POC Video: https://youtu.be/2CFJLwkxpT8 Vendor Homepage: https://codeawesome.in/embed/...
WebFairy Mediat 1.4.1 Cross Site Scripting
Exploit Title: Mediat 1.4.1 - Cross-site Script Google Dork: N/A Date: 1 Jan 2019 Exploit Author: Deyaa Muhammad Author EMail: contact at deyaa.me Author Blog: http://deyaa.me Vendor Homepage: http://webfairy.net/ Software Link: https://github.com/WebFairyNet/Mediat Demo Website:...
Liberapay: Current CSP Policy chained with HTML Injection can lead to Data Exfiltration
Hi Team, Summary While reviewing the CSP headers for en.liberapay.com i noticed that img-src has a source set to which means any source on the internet. The following is found in the current CSP Header config. img-src blob: data: Description: If the site is vulnerable to HTML Injection its possib...
inherentresolve.mil XSS vulnerability
Open Bug Bounty ID: OBB-559280 Description| Value ---|--- Affected Website:| inherentresolve.mil Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Check_MK 1.2.4 < 1.2.4p4 / 1.2.5 < 1.2.5i4 Multiple Vulnerabilities
The version of CheckMK running on the remote web server is 1.2.4 prior to 1.2.4p4 or 1.2.5 prior to 1.2.5i4. It is, therefore, affected by multiple vulnerabilities : - Multiple cross-site script XSS vulnerabilities exist in the multisite component, specifically within the renderstatusicons functi...
CVE-2016-6348
JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion XSSI attack...
CVE-2016-6348
JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion XSSI attack...
DEBIAN-CVE-2016-6348
JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion XSSI attack...
UBUNTU-CVE-2016-6348
JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion XSSI attack...
CVE-2016-6348
JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion XSSI attack...
Zomato: Instagram OAuth2 Implementation Leaks Access Token; Allows for Cross-Site Script Inclusion (XSSI)
Once a user connects his Zomato account to Instagram via OAuth2, the page https://www.zomato.com/php/instagramtagrelay leaks the Instagram OAuth2 Access Token issued to Zomato: PoC: https://www.zomato.com/php/instagramtagrelay?callback=aaabc Result personal data x'ed: HTTP/1.1 200 OK...
Wordpress Conversionninja 插件-/lp/index.php文件-跨站脚本漏洞
No description provided by source...
Security Advisory - Cross-Site Script Vulnerability in Policy Center
Huawei Policy Center dynamically allocates network resources in a unified manner, enabling the network to provide services with more agility. A cross-site scripting XSS vulnerability exists in Huawei Policy Center. The vulnerability is caused by incomplete input validation. An attacker with a...
Spotify ArtistExplorer BB #1 - Cross Site Script Vulnerability
Document Title: =============== Spotify ArtistExplorer BB 1 - Cross Site Script Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1662 Release Date: ============= 2016-04-16 Vulnerability Laboratory ID VL-ID:...
Coinbase: XSSI (Cross Site Script Inclusion)
Hi, https://www.coinbase.com/pusher/auth returns sensetive a json auth-token response that can be parsed by javascript JSON.parse from external site. this can easily be mitigated by putting // or // chars at the beginning of the json response and thus making functions like JSON.parse unable to ge...
XSS attack through intents on Firefox for Android — Mozilla
Security researcher Muneaki Nishimura reported that on Firefox for Android that it is possible to create a cross-site script XSS attack through the use of Android intents and fallback navigation. This issue is caused by improper sterilization of opened addresses sent to Firefox through intents...
Trailing whitespace in IP address hostnames can bypass same-origin policy — Mozilla
Security researcher Michał Bentkowski reported that adding white-space characters to hostnames that are IP addresses can bypass same-origin policy. This flaw was caused by trailing whitespaces being evaluated differently when parsing IP addresses instead of alphanumeric hostnames. This could lead...