6885 matches found
CVE-2017-1000461
Brave Browser (0.19.73 and earlier) is affected by CVE-2017-1000461 due to an incorrect access-control flaw in the JS fingerprinting blocking component. This vulnerability could allow a malicious website to access fingerprinting-related browser functionality that the browser intends to block. The...
CVE-2017-1000488
The CVE-2017-1000488 entry concerns Mautic 2.1.0–2.11.0, which is vulnerable to inline JavaScript XSS in Mautic forms on a landing page when GET parameters pre-populate the form. Root cause cited across sources is lack of sanitization on GET parameters used for pre-population. Consequences includ...
CVE-2017-1000466
Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of service and execution of javascript code...
PT-2018-5228
Name of the Vulnerable Software and Affected Versions Brave Browser versions 0.19.73 and earlier Description The issue is related to an incorrect access control problem in the "JS fingerprinting blocking" component. This allows a malicious website to access browser functionality that is intended ...
CVE-2017-1000461: Incorrect Permission Assignment for Critical Resource
Brave Software's Brave Browser, version 0.19.73 and earlier is vulnerable to an incorrect access control issue in the "JS fingerprinting blocking" component, resulting in a malicious website being able to access the fingerprinting-associated browser functionality that the browser intends to block...
CVE-2017-1000488: Improper Neutralization of Input During Web Page Generation
Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form...
Zomato: [www.zomato.com] Privilege Escalation - /php/restaurant_menus_handler.php
Introduction In the following ██████████ the endpoint /php/restaurantmenushandler.php was found. This endpoint is meant solely to be accessible for admins, however due to insufficient protections normal users can access this endpoint too. This results in any Zomato user being able to edit and...
NoSQL Exploitation Framework 2.0 - A Framework For NoSQL Scanning and Exploitation
A FrameWork For NoSQL Scanning and Exploitation Framework Authored By Francis Alexander. Added Features: First Ever Tool With Added Support For Mongo,Couch,Redis,H-Base,Cassandra Support For NoSQL WebAPPS Added payload list for JS Injection,Web application Enumeration. Scan Support for...
@cimpress/simple-auth-wrapper (>=2.2.0, <=2.2.3), @expo/auth0-lock (10.16.0) +18 more potentially affected by CVE-2017-17068 via auth0-js (>=8.0.0-beta.1, <=8.11.3)
auth0-js NPM version =8.0.0-beta.1, =2.2.0, =1.1.0, =1.1.0, =1.1.0, =1.0.0, =0.0.18, =1.5.0, =0.0.1, =10.8.0-beta.2, =1.0.8, =1.0.15 - ds-auth0-lock 1.0.0 and more Source cves: CVE-2017-17068 Source advisory: OSV:GHSA-3RPR-MG43-XHQ4...
GHSA-3RPR-MG43-XHQ4 auth0-js Privilege Escalation Vulnerability
A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with...
PT-2017-14072
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 63.0.3239.108 Opera affected versions not specified Description The issue is related to an inappropriate implementation in V8 WebAssembly JS bindings, allowing a remote attacker to inject arbitrary scripts or HT...
Regular Expression Denial Of Service (ReDoS)
ua-parser-js is vulnerable to regular expression denial of service ReDoS attacks. An attacker can pass a string value to the getOS function to cause a ReDoS...
Cross-Origin Resource Sharing (CORS) Vulnerability
auth0-js has cross-origin resource sharing CORS vulnerability . It does not perform origin verification and uses a popup callback page with auth0.popup.callback, allowing the attackers to get access the tokens of logged-in users by using unrestricted cross-origin post message requests. The...
Auth0 auth0.js cross-origin vulnerability
Auth0.js is the client library for Auth0. A cross-origin vulnerability exists in Auth0 auth0.js prior to 8.12. An attacker could use this vulnerability to obtain an authenticated user's token and invoke a service on behalf of the user if the target site or application uses a popup callback page v...
CVE-2017-17068
The CVE-2017-17068 entry concerns Auth0’s auth0.js library prior to 8.12. A cross-origin vulnerability allows an attacker to obtain authenticated users’ tokens and invoke services on behalf of a user when a site uses a popup callback page via auth0.popup.callback(). Affected software: auth0.js
CVE-2017-17068
A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with...
PT-2017-14695
Name of the Vulnerable Software and Affected Versions Auth0 auth0.js library versions prior to 8.12 Description A cross-origin issue has been discovered in the Auth0 auth0.js library. This issue allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if th...
CVE-2017-17068: Exposure of Sensitive Information to an Unauthorized Actor
A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with...
Cross-site Scripting (XSS)
Wordpress is vulnerable to cross-site scripting XSS attacks. These attacks are possible because .js files can be uploaded without the unfilteredhtml capability...