2438 matches found
Mail.ru: Seven DOM-Based XSS Vulnerabilities | Execution in Login Sequence
DOM based XSS in tz.mail.ru tz.mail.ru belongs to extended scope I was able to exploit DOM XSS at the following endpoints. The vulnerability was exploitable on forbidden pages and the root cause lies in jquery. text https://tz.mail.ru/a/ https://tz.mail.ru/a/js/ https://tz.mail.ru/www/...
FreeBSD : rt -- XSS via jQuery (416ca0f4-3fe0-11e9-bbdd-6805ca0b3d42)
BestPractical reports : The version of jQuery used in RT 4.2 and 4.4 has a Cross-site Scripting XSS vulnerability when using cross-domain Ajax requests. This vulnerability is assigned CVE-2015-9251. RT does not use this jQuery feature so it is not directly vulnerable. jQuery version 1.12 no longe...
rt -- XSS via jQuery
BestPractical reports: The version of jQuery used in RT 4.2 and 4.4 has a Cross-site Scripting XSS vulnerability when using cross-domain Ajax requests. This vulnerability is assigned CVE-2015-9251. RT does not use this jQuery feature so it is not directly vulnerable. jQuery version 1.12 no longer...
Joomla ModPPCSimpleSpotLight 1.2 / 3.0 CSRF / Shell Upload
Exploit Title : Joomla ModPPCSimpleSpotLight Modules 1.2/3.0 CSRF Shell Upload Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 04/03/2019 Vendor Homepage : pixelpointcreative.com Software Download Link :...
ZRECore 1.3.1 Database Configuration Disclosure
Exploit Title : ZRECore 1.3.1 Database Config Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 14/02/2019 Vendor Homepage : zend.com Software Download Link : github.com/zrecore/ZRECore/archive/master.zip Software Information Link :...
Cross-site Scripting (XSS)
jquery.terminal is vulnerable to cross-site scripting. It does not properly handle the formatting for backspaces and escape characters for terminal echo, allowing injection of malicious payload if the setting for anyLinks or invokeMethods is true...
Blueimp jQuery File Upload 9.22.0 Arbitrary File Upload
Exploit Title: Exploit for Blueimp's jQuery File Upload include include include include include include define BSIZE 1024 define DEBUG 1 define TESTONLY 0 void buildstring char p, char path, char arg, char ar1, int func; int main int argc, char argv int sock = 0, bytesread = 0, total = 0, functio...
Reflected Cross-Site Scripting
Overview Versions of jquery.terminal prior to 1.21.0 are vulnerable to Reflected Cross-Site Scripting. If the application has either of the options anyLinks or invokeMethods set to true, the application may execute arbitrary JavaScript through crafted malicious payloads due to insufficient...
Blueimps jQuery File Upload 9.22.0 - Arbitrary File Upload Exploit
Blueimps jQuery File Upload 9.22.0 - Arbitrary File Upload Exploit Exploit Title: Exploit for Blueimp's jQuery File Upload include include include include include include define BSIZE 1024 define DEBUG 1 define TESTONLY 0 void buildstring char p, char path, char arg, char ar1, int func; int main...
Blueimp's jQuery File Upload 9.22.0 - Arbitrary File Upload Exploit
Exploit Title: Exploit for Blueimp's jQuery File Upload include include include include include include define BSIZE 1024 define DEBUG 1 define TESTONLY 0 void buildstring char p, char path, char arg, char ar1, int func; int main int argc, char argv int sock = 0, bytesread = 0, total = 0, functio...
Cross-site Scripting (XSS) Via Dialog CloseText
jquery-ui is vulnerable to cross-site scripting XSS attacks. A malicious user can execute arbitrary code to the closeText parameter of the dialog function...
Cross-site Scripting (XSS)
jquery-ui is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary script via the dialog due to a lack of sanitization...
Roxy Fileman 1.4.5 - Unrestricted File Upload Directory Traversal
Roxy Fileman 1.4.5 - Unrestricted File Upload Directory Traversal ====================================================================== Exploit Title:: Multiple Vulnerabilities Software: Roxy Fileman Version: 1.4.5 Vendor Homepage: http://www.roxyfileman.com/ Software Link:...
HackerOne: Cross-site Scripting (XSS) on HackerOne careers page
Dear HackerOne team, Summary: I found DOM XSS at endpoint https://www.hackerone.com/careers, but can not bypass CSP. It's work on IE and Edge. Steps To Reproduce - JS file is "Masonry js file", vulnerability code: javascript //Checking for potential Lever source or origin parameters var pageUrl =...
Fedora 28 : python-XStatic-jquery-ui (2018-f972c1b36e)
Update Python 2 dependency declarations to new packaging standards Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...
Typo3 CMS YAG Themepack jQuery 1.3.2 Database Disclosure
Exploit Title : Typo3 CMS YAG Themepack jQuery Extension 1.3.2 Database Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 02/01/2019 Vendor Homepage : typo3.org yag-gallery.de Software Download Link :...
SmartWorks Systems Pakistan 1.0 SQL Injection
Exploit Title : SmartWorks Systems Pakistan 1.0 SQL Injection Author Discovered By : KingSkrupellos Date : 30/12/2018 Vendor Homepage : smartworks.pk Tested On : Windows Exploit Risk : Medium Category : WebApps Version Information : Nginx 1.14.1 - jQuery 1.11.1 - jQuery UI 1.10.4 CWE : CWE-89...
WordPress Cvp-Adegrontec 4.8.3 Shell Upload
Exploit Title : WordPress Cvp-Adegrontec Themes 4.8.3 Remote Shell Upload Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 22/12/2018 Vendor Homepage : wordpress.org Software Download Link : N/A Tested On : Windows and Linux Category : WebApps Version...
WordPress Firma Rehberi 4.9.9 Shell Upload / SQL Injection
Exploit Title : WordPress Firma Rehberi Themes 4.9.9 SQL Injection and Remote Shell Upload Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 22/12/2018 Vendor Homepage : wordpress.org temafabrika.com/demo/rehber3/ Software Download Link :...
