10961 matches found
Joomla 2.5.x < 3.9.19 Multiple Vulnerabilities (5812-joomla-3-9-19)
According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.19. It is, therefore, affected by multiple vulnerabilities. - In Joomla! before 3.9.19, lack of input validation in the heading tag option of the Articles - Newsflash and Article...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS. XSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to JQLite methods like JQLite.prepend, JQLite.after, JQLite.append, JQLite.replaceWith,...
8x8: DOM Based XSS at docs.8x8.com
A domain for marketing documentation contained a DOM based XSS due to evaluation and rendering of window.location.href in the related javascript...
Use of insecure jQuery version in OctoberCMS
Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. Patches Issue has been patched in Build 466 v1.0.466 by applying the recommended patch from @jquery. Workarounds Apply...
Exploit for Cross-site Scripting in Bludit
Author: Andre k Lorenci Contact: [email protected] CVE-2020-1...
Open Redirection
mediawiki is vulnerable to open redirection. Having duplicate DOM query in the resources/src/mediawiki.page.ready/ready.js on a logout click allows an attacker to force a logout and external redirection of the usere using HTML content in a MediaWiki page...
Urban Dictionary: DOM XSS through ads
Multiple ads hosted on www.urbandictionary.com make the www.urbandictionary.com origin vulnerable to DOM XSS. Attached is an image of alertdocument.domain executing. The injection works in Firefox and Chrome. Visiting the following URL will probably cause an alert box displaying the document.doma...
NewStart CGSL CORE 5.04 / MAIN 5.04 : xerces-c Vulnerability (NS-SA-2020-0028)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has xerces-c packages installed that are affected by a vulnerability: - The Apache Xerces-C 3.0.0 to 3.2.2 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been...
FreeBSD : drupal -- Multiple Vulnerabilities (c5ec57a9-9c2b-11ea-82b8-4c72b94353b5)
Drupal Security Team reports : The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the jQuery blog, both are: ... Security issues in jQuerys DOM manipulation methods, as in .html, .append, and the...
Xiaomi: DOM-based XSS in d.miwifi.com on IE 11
There is a DOM based XSS on d.miwifi.com but it only works on IE 11...
Drupal 7.0.x < 7.70 / 7.0.x < 7.70 / 8.7.x < 8.7.14 / 8.8.x < 8.8.6 Multiple Vulnerabilities (drupal-2020-05-20)
According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.70, 7.0.x prior to 7.70, 8.7.x prior to 8.7.14, or 8.8.x prior to 8.8.6. It is, therefore, affected by multiple vulnerabilities. - In jQuery versions greater than or equal to 1.2 an...
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2020-002
The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the jQuery blog, both are ... security issues in jQuery’s DOM manipulation methods, as in .html, .append, and the others. Security advisories for...
DuckDuckGo: DOM XSS on duckduckgo.com search
Hello, The is a DOM XSS vulnerability on https://duckduckgo.com search through the relsexp parameter. PoC URL: https://duckduckgo.com/?q=a&relsexp="&ia=web Screenshot: F830875 Video: F830880 Impact The attacker can execute JS code...
CVE-2020-7809
ALSong 3.46 and earlier version contain a Document Object Model DOM based cross-site scripting vulnerability caused by improper validation of user input. A remote attacker could exploit this vulnerability by tricking the victim to open ALSong Albumsab file...
Cross site scripting
ALSong 3.46 and earlier version contain a Document Object Model DOM based cross-site scripting vulnerability caused by improper validation of user input. A remote attacker could exploit this vulnerability by tricking the victim to open ALSong Albumsab file...
CVE-2020-7809
CVE-2020-7809 affects ALSong 3.46 and earlier. The vulnerability is a DOM-based cross-site scripting issue caused by improper validation of user input within ALSong, exploited when a victim is tricked into opening an ALSong Album(sab) file. The Red Hat and CNVD entries corroborate the same descri...
CVE-2020-7809 Estsoft ALSong DOM-Based XSS Vulnerability
ALSong 3.46 and earlier version contain a Document Object Model DOM based cross-site scripting vulnerability caused by improper validation of user input. A remote attacker could exploit this vulnerability by tricking the victim to open ALSong Albumsab file...
dom-termo.ru Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1160670 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
CVE-2020-2017
A DOM-Based Cross Site Scripting Vulnerability exists in PAN-OS and Panorama Management Web Interfaces. A remote attacker able to convince an authenticated administrator to click on a crafted link to PAN-OS and Panorama Web Interfaces could execute arbitrary JavaScript code in the administrator's...
CVE-2020-2017
CVE-2020-2017 describes a DOM-based cross-site scripting vulnerability in PAN-OS/Panorama management web interfaces. A remote attacker can trick an authenticated administrator into clicking a crafted link, potentially executing arbitrary JavaScript in the admin’s browser and performing administra...