6880 matches found
Deserialization Code Execution
Overview Versions 2.0.4 and earlier of js-yaml are affected by a code execution vulnerability in the YAML deserializer. Proof of Concept const yaml = require'js-yaml'; const x = test: !!js/function function f console.log1; ; yaml.loadx; Recommendation Update js-yaml to version 2.0.5 or later, and...
Reflected Cross-Site Scripting (XSS) in SourceBans
High-Tech Bridge Security Research Lab discovered vulnerability in SourceBans, which can be exploited to perform Cross-Site Scripting XSS attacks against web application users. The vulnerability exists due to insufficient filtration of input-data passed via the "advSearch" HTTP GET parameter to...
PT-2015-7345
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 47.0.2526.73 Opera affected versions not specified Description The issue is related to the improper implementation of certain map and filter operations for arrays in the js/array.js file of Google V8. This allow...
PT-2015-2164
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 41.0 Description The issue is related to the mishandling of certain receiver arguments in the js/src/proxy/Proxy.cpp component, which can be exploited by remote attackers to bypass intended window access...
CVE-2015-6969
Cross-site scripting XSS vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link...
PT-2015-7429
Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.0.2 Description A cross-site scripting XSS issue exists due to improper handling of user input in the 2k11 theme, specifically in the js/2k11.min.js file. This allows remote attackers to inject arbitrary web...
CVE-2015-6969: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link...
CVE-2015-6920
Cross-site scripting XSS vulnerability in js/window.php in the sourceAFRICA plugin 0.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter...
PT-2015-7404
Name of the Vulnerable Software and Affected Versions sourceAFRICA plugin version 0.1.3 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter in the js/window.php file...
CVE-2015-6920: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in js/window.php in the sourceAFRICA plugin 0.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter...
AnyMacro邮件系统存储XSS漏洞2(可盲打其它用户)
简要描述： 第一弹被忽略了，目测是厂商一直没关注wooyun，导致过期自动忽略的。 可以考虑直接转交给CNCERT处理 http://www.wooyun.org/bugs/wooyun-2010-0136531 详细说明： 据说乌云已经把它列入到通用型奖励厂商当中了。 0x01 背景 AnyMacro（安宁）成立于1999年，是国内领先的统一消息/移动门户/PushMail产品与应用解决方案提供商。主要客户涵盖国家部委、大型企业以及部分海外客户，客户分布于政府、军工、金融、电信、能源、教育等行业。...
WordPress Contact Form Generator <= 2.0.1 - Multiple CSRF Vulnerabilities
Exploit for php platform in category web applications Live Demos. It is packed with a Template Creator Wizard to create fantastic forms in a matter of seconds without coding. copy of ´contactformgenerator.php´ file =================== TECHNICAL DETAILS =================== A CSRF issue was found i...
CVE-2015-2807
The CVE-2015-2807 issue affects the WordPress Navis DocumentCloud plugin, specifically versions before 0.1.1. The vulnerability resides in the js/window.php file where the wpbase parameter is used, enabling a reflected cross-site scripting (XSS) attack. An attacker can inject arbitrary script/HTM...
WordPress sourceAFRICA 0.1.3 Cross Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title : Wordpress sourceAFRICA Plugin Cross Site Scripting Exploit Author : Ashiyane Digital Security Team Vendor Homepage : https://wordpress.org/plugins/sourceafrica/ Date: 2015-08-29 Tested On : Elementary Os - Firefox Software Link...
PT-2015-5902
Name of the Vulnerable Software and Affected Versions Navis DocumentCloud plugin versions prior to 0.1.1 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter in the...
CVE-2015-2807: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter...
CVE-2 0 1 5-4 4 8 3: Use the feed Protocol to bypass the Firefox Mixed Content Blocker-bug warning-the black bar safety net
In Firefox 4 0. fixes a bug number for CVE-2 0 1 5-4 4 8 3 BUG. Usually Firefox can prevent the following Mixed Content mixed content: the https://mkpocapp.appspot.com/bug1148732/victim In short: the https site has a portion of the content is via the http transmission, such as resource files, etc...
WordPress sourceAFRICA 0.1.3 Cross Site Scripting
Exploit Title : Wordpress sourceAFRICA Plugin Cross Site Scripting Exploit Author : Ashiyane Digital Security Team Vendor Homepage : https://wordpress.org/plugins/sourceafrica/ Date: 2015-08-29 Tested On : Elementary Os - Firefox Software Link :...
Google Chrome < 44.0.2403.157 Bypass Anti-XSS filter Vulnerability
影响版本：Google Chrome〈 44.0.2403.157 已知Google Chrome具有XSS防护机制，防止执行XSS中的的JS代码。下面有一段PHP代码：?php // Echo the value of parameter one echo "This is text1:".$GET'text1'."brbr"; // Echo the value of parameter two echo "This is text2:".$GET'text2'."brbr"; ?...
