ThinkPHP官网存储型XSS

简要描述： 对部分内容处理不当导致用户可在帖子中植入恶意js代码进而进行跨站脚本攻击 详细说明： 由于对附件名称没有进行escape，导致用户可以通过修改文件名为恶意的HTML代码进一步将其植入到帖子中，下面是官方讨论板块演示： 漏洞证明： 一旦恶意代码被植入成功后，所有浏览该页面的用户都会受到跨站脚本攻击。...

Taobao decoration can reference external js file-bug warning-the black bar safety net

Taobao decoration page for the js filter is not strict you can use user reference to an external js file, you can obtain other Taobao user cookies, modify your own shop reviews, baby sell number and the like. In Taobao decoration page that has a background image uploaded, as long as firebug for...

IPSwitch IMail Server WEB client 12.4 persistent XSS

Exploit for windows platform in category web applications Exploit Title: IPSwitch IMail Server WEB client 12.4 persistent XSS Google Dork: Date: 3 june 2014 Exploit Author: Peru GoSecure! Vendor Homepage: www.ipswitch.com Software Link: http://www.imailserver.com/try/ Version: Tested on 12.3 and...

PT-2014-3530 · Red Hat · Rhevm-Reports

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization Manager reports rhevm-reports versions prior to 3.3.3-1 Description: The issue allows local users to obtain sensitive information by reading a configuration file due to world-readable permissions. The file in...

ovirt-engine-reports: js-jboss7-ds.xml is world-readable

The Red Hat Enterprise Virtualization Manager reports rhevm-reports package before 3.3.3-1 uses world-readable permissions on the datasource configuration file js-jboss7-ds.xml, which allows local users to obtain sensitive information by reading the file...

Mail.ru: Reflected XSS in User-Agent

Уязвимость существует на сайтах: 11x11.mail.ru s2.11x11.mail.ru Злоумышленник может внедрить произвольный User-Agent, содержащий JS код. Для примера - alert/BigBear/!--...

PHPYUN云人才系统多处存储型XSS打包

简要描述： 梦见一个getshell，但因为该死的过滤没绕过。。发xss吧。。。 多处打包，还不走大厂商吗？ 详细说明： phpyun云人才系统处理富文本时，只在客户端进行过滤，服务端没有进行过滤，导致多个富文本编辑框产生XSS。 说一下各个位置。 01.企业用户资料处：member/index.php?C=info 02.企业用户发布招聘信息处：member/index.php?C=jobadd 03.问答系统提问处：ask/index.php?C=addquestion 04.朋友圈发表状态：friend/index.php...

StartBBS v1.1.5存储型xss

简要描述： 存储型xss。 详细说明： 用户资料修改处，可以填写用户网站。 一般填写url的地方容易出现xss，很多人忽略。 观察代码，app/controllers/settings.php 36行 $data = array 'uid' = $uid, 'email' = striptags$this-input-post'email', 'homepage' = prepurlstriptags$this-input-post'homepage', 'location' = striptags$this-input-post'location', 'qq' =...

WordPress Js-Multi-Hotel Plugin Multiple Vulnerabilities

The WordPress plugin SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...

Multiple vulnerabilities in Js-Multi-Hotel for WordPress

Hello 3APA3A! There are multiple vulnerabilities in Js-Multi-Hotel plugin for WordPress. Earlier I wrote about two other vulnerabilities. These are Abuse of Functionality, Denial of Service, Cross-Site Scripting and Full path disclosure vulnerabilities in Js-Multi-Hotel plugin for WordPress. Ther...

XSS and FPD vulnerabilities in Js-Multi-Hotel for WordPress

Hello 3APA3A! These are vulnerabilities in Js-Multi-Hotel plugin for WordPress. ------------------------- Affected products: ------------------------- Vulnerable are Js-Multi-Hotel 2.2.1 and previous versions. ------------------------- Affected vendors: ------------------------- Joomlaskin...

Vulnerabilities in Js-Multi-Hotel for WordPress

Hello 3APA3A! These are vulnerabilities in Js-Multi-Hotel plugin for WordPress. ------------------------- Affected products: ------------------------- Vulnerable are Js-Multi-Hotel 2.2.1 and previous versions. ------------------------- Affected vendors: ------------------------- Joomlaskin...

KLA10121 SUI vulnerability in Mozilla Firefox

Unspecified vulnerability was found in the Mozilla Firefox. By exploiting this vulnerability malicious users can spoof the address bar. This vulnerability can be exploited remotely at a point related to DOM events via a specially designed JS. Original advisories MFSA Related products...

WordPress JS External Link Info Cross Site Scripting

Exploit Title : Wordpress Wp Js External link Info Cross Site Scripting Exploit Author : Ashiyane Digital Security Team Vendor Homepage : http://wordpress.org Google Dork : inurl:wp-content/plugins/wp-js-external-link-info Date : 2014/4/16 Tested on : Windows 7 , Linux Version : 1.21 Exploit :...

PhotoWIFI Lite 1.0 iOS - Multiple Vulnerabilities

PhotoWIFI Lite 1.0 iOS - Multiple Vulnerabilities Document Title: =============== PhotoWIFI Lite v1.0 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1239 Release Date: ============= 2014-03-27 Vulnerability Laboratory ...

Lazybone Studios WiFi Music 1.0 iOS - Multiple Vulnerabilities

Document Title: =============== Lazybone Studios WiFi Music 1.0 iOS - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1233 Release Date: ============= 2014-03-21 Vulnerability Laboratory ID VL-ID:...

DSA-2882-1 extplorer - security update

Bulletin has no description...

Debian: Security Advisory (DSA-2882-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MoneyStream: Here is another XSS i got for you

I ve verified it and it does trigger a JS alert POST /blog/ HTTP/1.1 Host: moneystream.com Accept: / Accept-Language: en User-Agent: Mozilla/5.0 compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0 Connection: close Referer: https://moneystream.com/blog/ Cookie:...

Slack: Stored XSS in username.slack.com

Hi There is a stored XSS in username.slack.com. Steps to reproduce: 1. Login to your Slack 2. Goto "Create Private Group" and with any name and purpose 3. Goto https://manish.slack.com/messages/group/files/ 4. Upload a file hitting upload icon ^ filename shall be ".jpeg 5. After file is uploaded...