10891 matches found
Cross-Site Scripting (XSS)
PrettyPhoto is vulnerable to DOM-based cross-site scripting XSS. The attack is possible because it fails to encode special characters from user provided data after the in the URL. The vulnerability exists in the getHashtag function of js/jquery.prettyPhoto.js, allowing an attacker to inject...
Cisco Unified Intelligence Center Cross-Site Scripting Vulnerability
A vulnerability in the Cisco Unified Intelligence Center web interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing a Document Object Model DOM-based, environment or client-side cross-site scripting XSS attack. The vulnerability occurs because...
U.S. Dept Of Defense: [█████] — DOM-based XSS on endpoint `/?s=`
Description GET parameter s is vulnerable to DOM-based XSS on endpoint /?s=. XSS affects all users and no authentication or login is required. Proof of Concept Visit the following URL for PoC: https://██████/?s=%27%3E%3Cscript%3Ealertdocument.domain%3C/script%3E █████████ Explanation This DOM-bas...
Service workers at TPAC
Last month we had a service worker meeting at the W3C TPAC conference in Fukuoka. For the first time in a few years, we focused on potential new features and behaviours. Here's a summary: Resurrection finally killed reg.unregister; If you unregister a service worker registration, it's removed fro...
Service workers at TPAC
Last month we had a service worker meeting at the W3C TPAC conference in Fukuoka. For the first time in a few years, we focused on potential new features and behaviours. Here's a summary: Resurrection finally killed reg.unregister; If you unregister a service worker registration, it's removed fro...
CVE-2019-16414
A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure&NTLM= URI...
CVE-2019-16414
A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure&NTLM= URI...
Default credentials
A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure&NTLM= URI...
ForeScout Technologies: DOM XSS at www.forescout.com in Microsoft Edge and IE Browser
Summary: I've found an DOM Based XSS on homepage Steps To Reproduce: 1.Go to this url and you'll see alert pop https://www.forescout.com/ But this will work just on ME/IE browsers because chrome and firefox have default encode system hash url And vulnerable code is on your directly source code...
CVE-2019-16414
CVE-2019-16414 affects GFI Kerio Control v9.3.0. A DOM-based XSS flaw in the login path (e.g., login/?reason=failure&NTLM=) can be used to embed malicious code and exfiltrate a victim’s credentials in cleartext. Multiple connected sources (NVD, Red Hat advisories, CVE pages, CNVD, CVE lists, and ...
CVE-2019-16414
A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure&NTLM= URI...
Razer: DOM XSS at https://www.thx.com in IE/Edge browser
Summary: I just recently found easy exploitable DOM XSS vulnerability because of https://www.thx.com/assets/plugins/ultimate-social-media-icons/js/custom.js?ver=5.2.3 js file Steps To Reproduce: First i want to say this is vulnerable code function sfsimobilewechatshareurl if...
Cross site scripting
DOM-based cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.2 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2019-5975
CVE-2019-5975 affects Cybozu Garoon 4.6.0–4.10.2 with a DOM-based cross-site scripting vulnerability in the Portal component (CWE-79). Root cause: insufficient input validation allows an authenticated user to cause arbitrary script/HTML execution in the user’s browser via unspecified vectors. Imp...
GHSA-536Q-8GXX-M782 Cross-Site Scripting in dojo
Versions of dojo prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting XSS. The package does not sanitize URL parameters in the testCommon.js and runner.html test files, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 1.4.2 o...
Cross-Site Scripting in dojo
Versions of dojo prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting XSS. The package does not sanitize URL parameters in the testCommon.js and runner.html test files, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 1.4.2 o...
Mail.ru: XSS via Cookie in Mail.ru
Unfiltered cookie content was used in DOM manipulation, leading to XSS possibility...
Fedora Update for seamonkey FEDORA-2019-e31c2f7d87
The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora Update for seamonkey FEDORA-2019-7f7489dc8c
The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...