6898 matches found
PRODSECBUG-2447: Using JS libraries with known security vulnerabilities
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
U.S. Dept Of Defense: [█████] — DOM-based XSS on endpoint `/?s=`
Description GET parameter s is vulnerable to DOM-based XSS on endpoint /?s=. XSS affects all users and no authentication or login is required. Proof of Concept Visit the following URL for PoC: https://██████/?s=%27%3E%3Cscript%3Ealertdocument.domain%3C/script%3E █████████ Explanation This DOM-bas...
WebKit - Universal XSS Using Cached Pages Exploit
VULNERABILITY DETAILS void FrameLoader::detachChildren ... SubframeLoadingDisabler subframeLoadingDisablermframe.document; // 1 Vector, 16 childrenToDetach; childrenToDetach.reserveInitialCapacitymframe.tree.childCount; for Frame child = mframe.tree.lastChild; child; child =...
WebKit - Universal XSS Using Cached Pages
WebKit - Universal XSS Using Cached Pages VULNERABILITY DETAILS void FrameLoader::detachChildren ... SubframeLoadingDisabler subframeLoadingDisablermframe.document; // 1 Vector, 16 childrenToDetach; childrenToDetach.reserveInitialCapacitymframe.tree.childCount; for Frame child =...
PT-2019-14751
Name of the Vulnerable Software and Affected Versions ThinkSAAS version 2.91 Description An issue was discovered where there is a potential for XSS via the content to the "index.php?app=group&ac=comment&ts=do&js=1" URI. This can be demonstrated by a crafted SVG document in the SRC attribute of an...
wbNj8EIMfXlmDDE
A Remote Browser's Agent XSS is a piece of software that allows a remote "operator" to control a browser as if he has physical access to that system. While desktop sharing and remote administration have many legal uses, "XSS" software is usually associated with criminal or malicious activity...
@agrc/helpers (>=1.0.0, <=1.0.1), @dojo/interop (>=4.0.0-alpha.1, <=7.0.0) +3 more potentially affected by CVE-2010-2273 via dojo (1.13.0)
dojo NPM version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on dojo and may be impacted: - @agrc/helpers =1.0.0, =4.0.0-alpha.1, =0.1.10, =0.1.12 - dijit 1.13.0 - dojox 1.13.0 Source cves: CVE-2010-2273 Source advisory: OSV:GHSA-536Q-8GXX-M782...
WordPress <= 5.2.2 - Cross-Site Scripting (XSS) in URL Sanitisation
Description According to the WordPress release notes: "Props to Soroush Dalili @irsdl from NCC Group for disclosing an issue with URL sanitization that can lead to cross-site scripting XSS attacks." Thanks to @irsdl's Hacker1 disclosure: JS - Numerical Entities JS - Hex Entities...
Local File Inclusion
larvitbase-www is vulnerable to local file inclusion. The package uses an exposed API endpoint that accepts an unvalidated GET parameter to a require function call. This could potentially allow a remote attacker to execute any .js files within the web server. Successful exploitation causes the...
Sentrifugo 3.2 - Persistent Cross-Site Scripting
Sentrifugo 3.2 - Persistent Cross-Site Scripting Exploit Title: Sentrifugo 3.2 - Persistent Cross-Site Scripting Google Dork: N/A Date: 8/29/2019 Exploit Author: creosote Vendor Homepage: http://www.sentrifugo.com/ Version: 3.2 Tested on: Ubuntu 18.04 CVE : CVE-2019-15814 Multiple Stored XSS...
Sentrifugo 3.2 - Persistent Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: Sentrifugo 3.2 - Persistent Cross-Site Scripting Exploit Author: creosote Vendor Homepage: http://www.sentrifugo.com/ Version: 3.2 Tested on: Ubuntu 18.04 CVE : CVE-2019-15814 Multiple Stored XSS vulnerabilities were found in...
GHSA-VX6V-2RG6-865H Cross-site Scripting in django-js-reverse
django-js-reverse aka Django JS Reverse before 0.9.1 has XSS via jsreverseinline...
Cross-site Scripting in django-js-reverse
django-js-reverse aka Django JS Reverse before 0.9.1 has XSS via jsreverseinline...
CVE-2018-21002
The js-support-ticket plugin before 2.0.6 for WordPress has CSRF...
CVE-2018-21002
The js-support-ticket plugin before 2.0.6 for WordPress has CSRF...
Cross site request forgery (csrf)
The js-support-ticket plugin before 2.0.6 for WordPress has CSRF...
CVE-2018-21002
The js-support-ticket plugin before 2.0.6 for WordPress has CSRF...
CVE-2018-21002
The CVE-2018-21002 entry affects the WordPress plugin js-support-ticket prior to version 2.0.6, which is vulnerable to Cross-Site Request Forgery (CSRF). The issue is caused by CSRF in the plugin’s handling of requests, enabling unintended state-changing actions on affected sites. NVD lists CVSS ...
PT-2019-10429
Name of the Vulnerable Software and Affected Versions js-support-ticket plugin versions prior to 2.0.6 Description The issue affects the js-support-ticket plugin for WordPress, allowing for CSRF attacks. Recommendations For versions prior to 2.0.6, update to version 2.0.6 or later to resolve the...
