5295 matches found
CVE-2020-6526
CVE-2020-6526 affects Google Chrome before 84.0.4147.89. An inappropriate implementation in the iframe sandbox could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. Public references in Debian and FreeBSD advisories align with a fixed version around 84.0.4147.89...
CVE-2020-6526
Inappropriate implementation in iframe sandbox in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...
CVE-2020-6526
Inappropriate implementation in iframe sandbox in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...
CVE-2019-12773
An issue was discovered in Verint Impact 360 15.1. At wfo/help/helppopup.jsp, the helpURL parameter can be changed to embed arbitrary content inside of an iFrame. Attackers may use this in conjunction with social engineering to embed malicious scripts or phishing pages on a site where this produc...
CVE-2019-12773
An issue was discovered in Verint Impact 360 15.1. At wfo/help/helppopup.jsp, the helpURL parameter can be changed to embed arbitrary content inside of an iFrame. Attackers may use this in conjunction with social engineering to embed malicious scripts or phishing pages on a site where this produc...
PT-2021-9173 · Openshift Container Platform · Kibana
Name of the Vulnerable Software and Affected Versions: OpenShift Container Platform's distribution of Kibana affected versions not specified Description: A flaw in OpenShift Container Platform's distribution of Kibana allows it to be opened in an iframe, enabling an attacker to intercept and...
U.S. Dept Of Defense: DOM XSS on https://www.███████
Description DOM XSS can be achieved due to missing sanitation when setting the source of an iframe. POC 1. Visit https://www.████frame.htmljavascript:alertdocument.domain 2. View alert Vulnerable Code javascript function Load str=document.location.hash,idx=str.indexOf'' ifidx=0 str=str.substr1;...
climate.hawaii.gov IFRAME Injection vulnerability OBB-1210714
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Mail.ru: HTML/iframe/XSS injection on https://www.ucs.ru/online/shelter/settings/check/
Potential XSS via POST parameters in www.ucs.ru...
doggyzworldkennel.com IFRAME Injection vulnerability OBB-1199983
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Sanitize Cross-Site Scripting Vulnerability
Sanitize is an HTML and CSS cleaner from Ryan Grove Software Developers in the USA that supports removing HTML and CSS from strings and more. A cross-site scripting vulnerability exists in Sanitize 3.0.0 and later versions fixed in version 5.2.1. When using Sanitize's "relaxed" configuration or...
UBUNTU-CVE-2020-4054
In Sanitize RubyGem sanitize greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's "relaxed" config, or a custom config that allows certain elements, some content in a math or svg element may not be sanitized...
comune.ragusa.gov.it IFRAME Injection vulnerability OBB-1196509
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Shopify: xss on polaris.shopify.com/demo using postMessage
Description it's possible to run arbitrary js code using https://polaris.shopify.com/demo + postMessage following codes are from this file which formatted using prettier Demo component line 381 uses addEventListener to listen for message events line 401: js componentDidMount...
andertons.co.uk IFRAME Injection vulnerability
Open Bug Bounty ID: OBB-1165857 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
galeria.de IFRAME Injection vulnerability
Open Bug Bounty ID: OBB-1165296 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
carteracura.com IFRAME Injection vulnerability
Open Bug Bounty ID: OBB-1161917 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
CVE-2020-10743
It was discovered that OpenShift Container Platform's OCP distribution of Kibana could open in an iframe, which made it possible to intercept and manipulate requests. This flaw allows an attacker to trick a user into performing arbitrary actions in OCP's distribution of Kibana, such as...
WordPress iframe Plugin < 4.5 XSS Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.113687";...
WordPress iframe cross-site scripting vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. iframe is an inline frame used to embed another document into the current HTML document. A security vulnerability exists in WordPress...