Cross site scripting

phpipam version 1.3.2 and earlier contains a Cross Site Scripting XSS vulnerability in The value of the phpipamredirect cookie is copied into an HTML tag on the login page encapsulated in single quotes. Editing the value of the cookie to r5zkh'alert1quqtl exploits an XSS vulnerability. that can...

Lyft: My Expense Report resulted in a Server-Side Request Forgery (SSRF) on Lyft

During a trip to a conference, I discovered that the Lyft app allowed users to create expense reports by exporting business ride history as a PDF or CSV file. Being an active Lyft user, this was excellent news to me since it made my life easier by simplifying the tedious process of work travel...

Tor Browser 7.0.8 Information Disclosure

Hi, there is the details for CVE-2017-16541 Tor Browser information disclosure, More infos at: https://www.wearesegment.com/research/tormoil-deanonymize-tor-browser-users-with-automount/ Tor Browser version 7.0.8, and probably prior, for Mac OS X and Linux, is affected by an information disclosur...

A week in security (May 14 – May 20)

Last week, we looked at the deluge of incoming policies caused by GDPR, tackled Adobe Reader zero days, and ran through some iPhone security tips. We also caught some helpline scammers in the act, explored advergaming, got our Senate Bill game face on, and deep dived into Drupal vulnerabilities...

Cross site scripting

The xssclean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross-site scripting XSS attacks via an unclosed HTML tag...

CVE-2013-4891

The xssclean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross-site scripting XSS attacks via an unclosed HTML tag...

CVE-2013-4891

The CVE-2013-4891 entry documents a vulnerability in CodeIgniter’s xss_clean function prior to version 2.1.4. An unclosed HTML tag could allow remote attackers to bypass protection and perform cross-site scripting (XSS). Affected software: CodeIgniter 2.x ≤ 2.1.3; vulnerable component: xss_clean ...

CVE-2013-4891

The xssclean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross-site scripting XSS attacks via an unclosed HTML tag...

CVE-2013-4891: Improper Neutralization of Input During Web Page Generation

The xssclean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross-site scripting XSS attacks via an unclosed HTML tag...

PT-2017-12135

Name of the Vulnerable Software and Affected Versions Joomla! versions prior to 3.7.4 Description The issue arises from inadequate filtering of potentially malicious HTML tags, leading to XSS vulnerabilities in various components. Recommendations For versions prior to 3.7.4, update to version 3.7...

Cross-Site Scripting (XSS) in HTML tag

Client-side scripts are used extensively by modern web applications. They perform from simple functions such as the formatting of text up to full manipulation of client-side data and Operating System interaction. Cross Site Scripting XSS allows clients to inject scripts into a request and have th...

DEBIAN-CVE-2016-9435

The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to tags...

UBUNTU-CVE-2016-9424

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m doesn't properly validate the value of tag attribute, which allows remote attackers to cause a denial of service heap buffer overflow crash and possibly execute arbitrary code via a crafted HTML page...

Mail.ru: Reflected XSS @ games.mail.ru

Hi, I've found a reflected XSS in games.mail.ru. The vulnerable parameter is url in /r area. PoC - Visit the following URL and click on javascript:alertdocument.domain - Alert will popup with domain. https://games.mail.ru/r/?url=javascript:alertdocument.domain F115537 - Also, to show current...

Open-Xchange: Cross-Site Scripting Vulnerability in dovecot.fi

Issue detail The name of an arbitrarily supplied URL parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e400a"alert15bd8b was submitted in the name of an arbitrarily supplied URL parameter. This input was echoed as...

Ximian Evolution 1.x - MIME image/* Content-Type Data Inclusion Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7119/info Ximian Evolution does not properly validate MIME image/ Content-Type fields. If an email message contains an image/ Content-Type, any type of data can be embedded where the image information is expected. This ca...

KingSoft Web Shield <= 1.1.0.62 XSS/Code Execution Vulnerability

No description provided by source. KingSoft Web Shield XSS and Remote Code Execution Vulnerability Found by inking Version = 1.1.0.62 Background: KingSoft Web Shield is a popular anti-malwebsites production of KingSoft Inc. around China. Details: When the KSWebShield detects a malwebsite, it send...

Apache Struts 2.0.0 2.2.1.1 - XWork s:submit HTML Tag Cross-Site Scripting

Apache Struts 2.0.0 2.2.1.1 - XWork s:submit HTML Tag Cross-Site Scripting source: https://www.securityfocus.com/bid/47784/info Apache Struts is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Successful exploitation requires 'Dynamic...

dotProject 2.1.3 - Cross-Site Scripting Improper Permissions

dotProject 2.1.3 - Cross-Site Scripting Improper Permissions Exploit Title: dotProject 2.1.3 XSS and Improper Permissions Date: Dec 15 2009 Author: h00die [email protected] & S0lus Software Link:...

dotProject 2.1.3 - Cross-Site Scripting / Improper Permissions

Exploit Title: dotProject 2.1.3 XSS and Improper Permissions Date: Dec 15 2009 Author: h00die [email protected] & S0lus Software Link: http://sourceforge.net/projects/dotproject/files/dotproject/dotProject%20Version%202.1.3/dotproject213.zip/download Version: 2.1.3 Tested on: BT4 pre-final Greetz to...