CVE-2017-17859

Samsung Internet Browser 6.2.01.12 allows remote attackers to bypass the Same Origin Policy, and conduct UXSS attacks to obtain sensitive information, via vectors involving an IFRAME element inside XSLT data in one part of an MHTML file. Specifically, JavaScript code in another part of this MHTML...

CVE-2017-17859: Improper Neutralization of Input During Web Page Generation

Samsung Internet Browser 6.2.01.12 allows remote attackers to bypass the Same Origin Policy, and conduct UXSS attacks to obtain sensitive information, via vectors involving an IFRAME element inside XSLT data in one part of an MHTML file. Specifically, JavaScript code in another part of this MHTML...

PT-2017-15052

Name of the Vulnerable Software and Affected Versions Samsung Internet Browser version 6.2.01.12 Description The issue allows remote attackers to bypass the Same Origin Policy and conduct UXSS attacks to obtain sensitive information. This is achieved via vectors involving an IFRAME element inside...

bgyellow.com IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-457569 Description| Value ---|--- Affected Website:| bgyellow.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Shee...

HackerOne: HTTP Parameter Pollution using semicolons in iframe element at hackerone.com/careers allows loading external Greenhouse forms

Summary: I noticed that HackerOne career pages loads it's application forms from Greenhouse.io via an iframe. The ghjid parameter value is taken into the iframe element for the token parameter in the iframe URL boards.greenhouse.io. Any html characters are escaped in order to avoid XSS and possib...

our.news IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-453421 Description| Value ---|--- Affected Website:| our.news Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

gee.gov.pt IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-448869 Description| Value ---|--- Affected Website:| gee.gov.pt Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Iframe Injection / CWE-79 CVSSv3 Score:| 6.1...

topsea.co.il IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-439881 Description| Value ---|--- Affected Website:| topsea.co.il Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Shee...

multiplay.co.il IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-439875 Description| Value ---|--- Affected Website:| multiplay.co.il Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

oddcast.com IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-439847 Description| Value ---|--- Affected Website:| oddcast.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

consentido.com.mx IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-432100 Description| Value ---|--- Affected Website:| consentido.com.mx Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

archivo.unionpuebla.mx IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-432093 Description| Value ---|--- Affected Website:| archivo.unionpuebla.mx Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

inprf-cd.gob.mx IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-432094 Description| Value ---|--- Affected Website:| inprf-cd.gob.mx Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

archivo.unionjalisco.mx IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-432091 Description| Value ---|--- Affected Website:| archivo.unionjalisco.mx Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

webist.in IFRAME Injection vulnerability

Vulnerable URL: http://www.webist.in/livedemo.php?url=http://openbugbounty.org Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| IFRAME Injection Vulnerability status:| Publicly disclosed Alexa Rank| 3007438 VIP website status:| No Coordinated Disclosure Timeline:...

agenziaastolfiscuola.it IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-429679 Description| Value ---|--- Affected Website:| agenziaastolfiscuola.it Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Iframe Injection / CWE-79 CVSSv3 Score:| 6.1...

Adobe Acrobat Pro DC iframe Same Origin Policy Bypass Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Mozilla: Cross-origin URL information leak through Resource Timing API (MFSA 2017-25)

The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox 57, Firefox ESR 52.5, and Thunderbird 52.5...

visitpa.com XSS vulnerability

Open Bug Bounty ID: OBB-418110 Description| Value ---|--- Affected Website:| visitpa.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

Mozilla Firefox Cross-Origin URL Information Disclosure Vulnerability

Mozilla Firefox browser Firefox is a free, open source browser for Windows, Linux and MacOSX platforms. A cross-origin URL information disclosure vulnerability exists in Mozilla Firefox versions prior to 57.0. The vulnerability arises because the Resource Timing API incorrectly discloses navigati...