X (Formerly Twitter): DOMXSS in Tweetdeck

Hi, I would like to report a DOMXSS issue in TweetDeck. Details In Tweetdeck, a tweet contains info of what client app the user used to sent the tweet. The render process is vulnerable to DOMXSS. In https://ton.twimg.com/tweetdeck-web/web/dist/bundle.6f91b4e832.js, the following line is responsib...

jQuery Suspicious URL Redirection (CVE-2018-18084)

A suspicious URL redirection to a possibly malicious jQuery domain has been encountered. By injecting JavaScript code, an attacker may redirect the user to an attacker-controlled website...

BK Mobile jQuery CMS 2.4 - Multiple Vulnerabilities

Exploit for php platform in category web applications Product : BK Mobile CMS Exploit Author : Rahul Pratap Singh Version : 2.4 Home page Link : http://codecanyon.net/item/jquery-mobile-website-with-full-admin-panel/2441358 Website : 0x62626262.wordpress.com Linkedin :...

Ruby on Rails jquery-ujs和jquery-rails安全绕过漏洞

Impact In the scenario where an attacker might be able to control the href attribute of an anchor tag or the action attribute of a form tag that will trigger a POST action, the attacker can set the href or action to " https://attacker.com" note the leading space that will be passed to JQuery, who...

BK Mobile CMS 2.4 Cross Site Scripting

FULL DISCLOSURE Product : BK Mobile CMS Exploit Author : Rahul Pratap Singh Version : 2.4 Home page Link : http://codecanyon.net/item/jquery-mobile-website-with-full-admin-panel/2441358 Website : 0x62626262.wordpress.com Linkedin : https://in.linkedin.com/in/rahulpratapsingh94 Date : 27/Jan/2016...

PHPIPAM 1.1.010 - Multiple Vulnerabilities

PHPIPAM 1.1.010 - Multiple Vulnerabilities Exploit Title: PHPIPAM v1.1.010 Multiple Vulnerabilities Date: 04/01/2016 Author: Mickael Dorigny @ Synetis Vendor or Software Link: http://phpipam.net/ Version: 1.1.010 Category: Multiple Vulnerabilities Tested on : 1.1.010 PHPIPAM description :...

Pinger Remote Code Execution

================================================================================ Pinger - Simple Pinging Webapp Remote Code Execution ================================================================================ Vendor Homepage: https://github.com/wcchandler/pinger Date: 17/12/2015 Software...

EvolutionScript 5.0 SQL Injection / Cross Site Scripting

evolutionscript v5.0 Mullti Vulnerability ========================================= Author : indoushka Vondor : http://EvolutionScript.com Dork : Powered by EvolutionScript Version 5.0 Copyright © 2010 - 2015 EvolutionScript.com ========================= Sql injection :...

WordPress Slideshow jQuery Image Gallery Plugin <=2.1.12 - Multiple Vulnerabilities

This plugin is prone to reflected cross site scripting vulnerability in "views/SlideshowPlugin/slideshow.php", "views/SlideshowPluginPostType/settings.php", "views/SlideshowPluginPostType/style-settings.php" and full path disclosure in multiple scripts. Solution Update plugin...

WordPress Slideshow jQuery Image Gallery Plugin <=2.1.12 - Multiple Vulnerabilities

This plugin is prone to reflected cross site scripting vulnerability in "views/SlideshowPlugin/slideshow.php", "views/SlideshowPluginPostType/settings.php", "views/SlideshowPluginPostType/style-settings.php" and full path disclosure in multiple scripts. Solution Update plugin...

[SECURITY] Fedora 21 Update: drupal7-jquery_update-2.7-1.fc21

Upgrades the version of jQuery in Drupal core to a newer version of jQuery. This package provides the following Drupal module: jqueryupdate...

[SECURITY] Fedora 22 Update: drupal7-jquery_update-2.7-1.fc22

Upgrades the version of jQuery in Drupal core to a newer version of jQuery. This package provides the following Drupal module: jqueryupdate...

[SECURITY] Fedora 23 Update: drupal7-jquery_update-2.7-1.fc23

Upgrades the version of jQuery in Drupal core to a newer version of jQuery. This package provides the following Drupal module: jqueryupdate...

[SECURITY] Fedora 23 Update: drupal7-jquery_update-2.6-1.fc23

Upgrades the version of jQuery in Drupal core to a newer version of jQuery. This package provides the following Drupal module: jqueryupdate...

[SECURITY] Fedora 23 Update: drupal7-active_tags-2.0-0.9.alpha1.fc23

Active Tags adds a new option to free tagging taxonomies. If selected the taxonomy widget is replaced by a new jQuery enabled tag entry widget. This package provides the following Drupal 7 module: activetags...

[SECURITY] Fedora 22 Update: drupal7-active_tags-2.0-0.9.alpha1.fc22

Active Tags adds a new option to free tagging taxonomies. If selected the taxonomy widget is replaced by a new jQuery enabled tag entry widget. This package provides the following Drupal 7 module: activetags...

[SECURITY] Fedora 21 Update: drupal7-active_tags-2.0-0.9.alpha1.fc21

Active Tags adds a new option to free tagging taxonomies. If selected the taxonomy widget is replaced by a new jQuery enabled tag entry widget. This package provides the following Drupal 7 module: activetags...

[SECURITY] Fedora 22 Update: drupal7-jquery_update-2.6-1.fc22

Upgrades the version of jQuery in Drupal core to a newer version of jQuery. This package provides the following Drupal module: jqueryupdate...

jQuery Update - Less Critical - Open Redirect - SA-CONTRIB-2015-158

The jQuery Update module enables you to update jQuery on your site. The module ships with a modified version of the core Overlay JavaScript file, which is vulnerable to an open redirect attack see SA-CORE-2015-004. Only sites with the Overlay module enabled are vulnerable. An incomplete fix for...

CSRF Vulnerability

Overview Versions 1.0.3 and earlier of jquery-ujs are vulnerable to an information leakage attack that may enable attackers to launch CSRF attacks, as it allows attackers to send CSRF tokens to external domains. When an attacker controls the href attribute of an anchor tag, or the action attribut...