919 matches found
Yelp: Possible content spoofing due to missing error page
https://hackerone.com/reports/164137 , https://hackerone.com/reports/115284 ETC GO TO https://www.yelp.com/%0ATEXT%20INJECT...
ExpressionEngine: Reflective XSS
URL http://blackdoorsec.net/sandbox/express/admin.php?/cp/members/bans&search=&sortcol=me%22%3E%3Cimg%20src=x%20onerror=promptdocument.domain%3Emberid&sortdir=desc URL Parameters /cp/members/bans search= sortcol=me%22%3E%3Cimg%20src=x%20onerror=promptdocument.domain%3Emberid sortdir=desc The...
Yelp: Error Page Text Injection
Hello Yelp team, Description : An attacker is able to inject his own text into error page and can fool the victim to visit his own malicious site. Please take a look at attached document, it contains POC as well as attack scenario about how the attacker can exploit this vulnerability and...
IBM WebSphere Application Server Liberty Information Disclosure Vulnerability
IBM WebSphere Application Server is an application server product developed and distributed by IBM in the United States, which is a platform for Java EE and Web services applications. IBM WebSphere Application Server The program fails to properly handle exceptions when the default error page does...
Cybozu Garoon fails to restrict access permissions
Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon fails to restrict access permissions in the error page. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the Information...
The vulnerability of the Firefox browser, which allows attackers to carry out spoofing attacks
The vulnerability of Firefox browsers is related to the incorrect installation of the "LINKABLE" and "URISAFEFORUNTRUSTEDCONTENT" flags, which are used for error pages. Exploiting this vulnerability allows a remote attacker to perform spear-phishing attacks using specially crafted URLs...
Nextcloud: demo.nextcloud.com: Content spoofing due to default Apache Error Page
Hello there , your site is vulnerable to phishing the users by this vulnerability. proof of concept...
Phabricator: Error page Text Injection.
AS we can see in report an user or attacker is able to inject his text into error page and can trap to user to visit other site by adding following link /test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.malicious.com%20so%20go%20to%20the%20new%20one%20since%20this%20one A...
Nextcloud: demo.nextcloud.com: Content spoofing due to default Apache Error Page
Hi ,I would like to report report a text injection and a miss-configuration of the 403 page which can be used in phishing. POC:...
bharathospitalityware.com XSS vulnerability
Vulnerable URL: http://bharathospitalityware.com/error.asp?msg=%3Cscript%3Ealert%27OPENBUGBOUNTY%27%3C/script%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...
The vulnerability of the Zyxel ZLD operating system allows a remote attacker to execute arbitrary code on the web server.
Exploiting a vulnerability in the operating system of the Zyxel ZyWALL USG 300 network firewall/switch allows a malicious actor to inject any desired web script through the Referer header. This is done by improperly handling the “404” error page, thereby compromising the integrity of data process...
Coinbase: Content Injection error page
poc url: https://images.coinbase.com/has.been.changed.to.https://images.attacker.com/,so.please.visit.https://images.attacker.com...
inbxx.com XSS vulnerability
Vulnerable URL: https://inbxx.com/Error/400?aspxerrorpath=...
Nextcloud: Content Spoofing/Text Injection - docs.nextcloud.org
Issue: ====== Hey, I've found content spoofing also known as "Text Injection" in your sub-domain docs.nextcloud.org URL: ------- Here is the malicious URL: https://docs.nextcloud.org/.htacessCONTENT%20SPOOFING%20BY%20AHSAN Fix: Use custom 403 error page which doesn't contain user's text! I hope...
SecNews: Text injection on error page.
An user or attacker is able to inject his text into error page and can trap to user to visit malicious sites. Even if the XSS or error custom based 404 pages error injecting is not on the scope of our program,our committee decided to disclose it publicly...
Vimeo: Error page Text Injection.
Error page text injection...
Trello: Error Page Text Injection.
AS we can see in report an user or attacker is able to inject his text into error page and can trap to user to visit other site by adding following link /test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.malicious.com%20so%20go%20to%20the%20new%20one%20since%20this%20one A...
Open redirect
Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging 1 custom code or 2 a form shown on a 404 error page, related to path manipulation...
UBUNTU-CVE-2016-3164
Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging 1 custom code or 2 a form shown on a 404 error page, related to path manipulation...
