SSRF Vulnerability in OpenSNS Social System

OpenSNS is a lightweight social user-centered framework based on OneThink for ... An SSRF vulnerability exists in /Public/js.php in OpenSNS Social System due to the program failing to adequately filter data. An attacker is allowed to exploit the vulnerability to probe intranet information...

[SECURITY] Fedora 23 Update: kf5-khtml-5.24.0-1.fc23

KHTML is a web rendering engine, based on the KParts technology and using K JS for JavaScript support...

[SECURITY] Fedora 24 Update: kf5-khtml-5.24.0-1.fc24

KHTML is a web rendering engine, based on the KParts technology and using K JS for JavaScript support...

DOM-based XSS

Overview Affected versions of gmail-js are vulnerable to cross-site scripting in the tools.parseresponse, helper.get.visibleemailspost, and helper.get.emaildatapost functions, which pass user input directly into the Function constructor. Recommendation Update to version 0.6.5 or later. References...

js-php.ru Open Redirect vulnerability

Vulnerable URL: http://js-php.ru/go.php?to=http://www.openbugbounty.org Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 10:56 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 4312286 VIP website...

Memory corruption

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3265...

CVE-2016-5733

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 a crafted table name that is mishandled during privilege checking in...

CVE-2016-5706: Undefined Security Weakness

js/getscripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service via a large array in the scripts parameter...

CVE-2016-5733: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 a crafted table name that is mishandled during privilege checking in...

Suspicious Webpage JavaScript Downloader

Certain malicious executable files can be hidden using js downloader file. A remote attacker could exploit this vulnerability to entice unsuspecting users to execute arbitrary files...

MS15-1 0 6 JavaScript ArrayBuffer. slice any address read-vulnerability analysis-vulnerability warning-the black bar safety net

2 0 1 5 year 8 month 1 3 day, Microsoft released the Update Patch security bulletin MS15-1 0 6, which contains the About Internet Explorer multiple vulnerabilities. Before, we have explained how to attack the VBScript engine inside the Filter function in the presence of type confusion...

Microsoft Internet Explorer XSS Filter Bypass (MS16-063: CVE-2016-3212)

A remote code execution vulnerability exists in Microsoft Internet Explorer. The vulnerability is due to the way the JS prevents an object from loading. A remote attacker can exploit this issue by enticing a user to open a specific web-page with a relevant query on an affected version of Internet...

PT-2016-6184

Name of the Vulnerable Software and Affected Versions Citrix NetScaler Gateway versions prior to 11.0 Build 66.11 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the NSC TMAC cookie. This occurs in the vpn/js/gateway login form view....

CVE-2016-4945: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in vpn/js/gatewayloginformview.js in Citrix NetScaler Gateway 11.0 before Build 66.11 allows remote attackers to inject arbitrary web script or HTML via the NSCTMAC cookie...

BurpSuiteJSBeautifier - Burp Suite JavaScript Beautifier

Most of the websites compress their resources such as JS files in order to increase the loading speed. However, security testing and debugging a compressed resource is not an easy task. This is a Burp Suite open source extension which makes it possible to beautify most of the resources properly...

Angular JS template injection vulnerability analysis-vulnerability warning-the black bar safety net

Weekend Mining the vulnerabilities of the process, found an interestingXSS, is to use the Angular JS template to be injected, thereby executing the malicious code, The idea and technology is relatively novel. Angular JS is one of the more popular front end MVC frameworks, many cutting-edge sites...

Wordpress Js-Multi-Hotel 插件-refreshDate.php文件-跨站脚本漏洞

No description provided by source...

safe-editor <= 1.1 - Unauthenticated CSS/JS-injection

When saving JS/CSS in this plugin then both private and public ajax-hooks are being used. Because of this anyone can post JS/CSS that are saved to the db and printed to the head and footer portion of the page. PoC In the file "index.php" in root folder on line 188 and 189 you can see that both...

WordPress Safe Editor Plugin <= 1.1 - Multiple Vulnerabilities

This plugin is prone to an unauthenticated CSS and JS injection. The attackers can inject whatever they want when "wpfooter" and "wphead" is called, because "sesave" function is not sanitized. Solution Update the plugin...

The vulnerability of Google Chrome allows a hacker to inject any Web or HTML code they desire.

The vulnerability of the ModuleSystem::RequireForJsInner function extensions/renderer/modulesystem.cc in the Google Chrome browser’s Extensions subsystem exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to injec...