CVE-2018-6654

The Grammarly extension before 2018-02-02 for Chrome allows remote attackers to discover authentication tokens via an 'action: "user"' request to iframe.gr-ifr, because the exposure of these tokens is not restricted to any specific web site...

CVE-2018-6654

The Grammarly extension before 2018-02-02 for Chrome allows remote attackers to discover authentication tokens via an 'action: "user"' request to iframe.gr-ifr, because the exposure of these tokens is not restricted to any specific web site...

Node.js third-party modules: [crud-file-server] Stored XSS in filenames when directory index is served by crud-file-server

Hi Guys, crud-file-server allows to embed HTML in file names, which in certain conditions might lead to execute malicious JavaScript. Module crud-file-server This package exposes a directory and its children to create, read, update, and delete operations over http...

Node.js third-party modules: [glance] Stored XSS via file name allows to run arbitrary JavaScript when directory listing is displayed in browser

Hi Guys, There is a Stored XSS vulnerability in glance module. File name, which contains malicious HTML eg. embedded iframe element or javascript: pseudoprotocol handler in element allows to execute JavaScript code against any user who opens directory listing contains such crafted file name. Modu...

Node.js third-party modules: [anywhere] An iframe element with url to malicious HTML file (with eg. JavaScript malware) can be used as filename and served via anywhere

Hi Guys, anywhere allows to embed HTML in file names, which in certain conditions might lead to execute malicious JavaScript. Module: Running static file server anywhere. https://www.npmjs.com/package/anywhere Description To embed malicious tag with JavaScript code to execute, / character is...

psycline.org IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-544482 Description| Value ---|--- Affected Website:| psycline.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Iframe Injection / CWE-79 CVSSv3 Score:| 6.1...

gflora.com IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-544270 Description| Value ---|--- Affected Website:| gflora.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Iframe Injection / CWE-79 CVSSv3 Score:| 6.1...

greatlakescalibration.com IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-544268 Description| Value ---|--- Affected Website:| greatlakescalibration.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Iframe Injection / CWE-79 CVSSv3 Score:| 6.1...

lowther-holidaypark.co.uk IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-544258 Description| Value ---|--- Affected Website:| lowther-holidaypark.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Iframe Injection / CWE-79 CVSSv3 Score:| 6.1...

downfieldstudio.com IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-544255 Description| Value ---|--- Affected Website:| downfieldstudio.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Iframe Injection / CWE-79 CVSSv3 Score:| 6.1...

la-colombiere.ch IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-544253 Description| Value ---|--- Affected Website:| la-colombiere.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Iframe Injection / CWE-79 CVSSv3 Score:| 6.1...

elloracaves.org IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-544250 Description| Value ---|--- Affected Website:| elloracaves.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Iframe Injection / CWE-79 CVSSv3 Score:| 6.1...

afoc.mil.ae IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-544249 Description| Value ---|--- Affected Website:| afoc.mil.ae Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Iframe Injection / CWE-79 CVSSv3 Score:| 6.1...

friendsofdunhuang.org IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-544234 Description| Value ---|--- Affected Website:| friendsofdunhuang.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Iframe Injection / CWE-79 CVSSv3 Score:| 6.1...

carib.customs.gov.tt IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-544197 Description| Value ---|--- Affected Website:| carib.customs.gov.tt Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Iframe Injection / CWE-79 CVSSv3 Score:| 6.1...

pkapp.pka.gov.my IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-544194 Description| Value ---|--- Affected Website:| pkapp.pka.gov.my Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Iframe Injection / CWE-79 CVSSv3 Score:| 6.1...

army.mil.ph IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-544179 Description| Value ---|--- Affected Website:| army.mil.ph Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Iframe Injection / CWE-79 CVSSv3 Score:| 6.1...

headlines24.nl IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-533734 Description| Value ---|--- Affected Website:| headlines24.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Iframe Injection / CWE-79 CVSSv3 Score:| 6.1...

Transmission - RPC DNS Rebinding

The transmission bittorrent client uses a client/server architecture, the user interface is the client and a daemon runs in the background managing the downloading, seeding, etc. Clients interact with the daemon using JSON RPC requests to a web server listening on port 9091. By default, the daemo...

RIG exploit kit campaign gets deep into crypto craze

There isn't a day that goes by without a headline about yet another massive spike in Bitcoin valuation, or a story about someone mortgaging their house to purchase the hardware required to become a serious cryptocurrency miner. If many folks are thinking about joining the 'crypto craze' movement,...