514 matches found
http-jsonp-detection NSE Script
Attempts to discover JSONP endpoints in web servers. JSONP endpoints can be used to bypass Same-origin Policy restrictions in web browsers. The script searches for callback functions in the response to detect JSONP endpoints. It also tries to determine callback function through URLcallback functi...
WakaTime: [wakatime.com] HTML Injection github-btn.html
Description === Vulnerable parameter: user Vulnerable script: https://wakatime.com/static/html/github-btn.html Vulnerable code: js var params = function var vars = , hash; var hashes = window.location.href.slicewindow.location.href.indexOf"?" + 1.split"&"; forvar i = 0; i...
ASUS Patches RT Router Vulnerabilities
A recent ASUS firmware update addressed a number of vulnerabilities in 30 models of its popular RT routers. The flaws were privately disclosed by researchers at Baltimore consultancy Nightwatch Cybersecurity, and were patched starting in March, with 10 updates added Wednesday. Users should ensure...
ASUS Routers CSRF / Information Disclosure Vulnerabilities
ASUS routers suffer from cross site request forgery and information disclosure vulnerabilities. Versions affected include RT-AC55U, RT-AC56R, RT-AC56S, RT-AC56U, RT-AC66U, RT-AC88U, RT-AC66R, RT-AC66U, RT-AC66W, RT-AC68W, RT-AC68P, RT-AC68R, RT-AC68U, RT-AC87R, RT-AC87U, RT-AC51U, RT-AC53U,...
CVE-2017-5892
ASUS RT-AC and RT-N devices with firmware before 3.0.0.4.380.7378 allow JSONP Information Disclosure such as a network map...
CVE-2017-8877
ASUS RT-AC and RT-N devices with firmware through 3.0.0.4.380.7378 allow JSONP Information Disclosure such as the SSID...
Information disclosure
ASUS RT-AC and RT-N devices with firmware before 3.0.0.4.380.7378 allow JSONP Information Disclosure such as a network map...
Information disclosure
ASUS RT-AC and RT-N devices with firmware through 3.0.0.4.380.7378 allow JSONP Information Disclosure such as the SSID...
CVE-2017-5892
ASUS RT-AC and RT-N devices with firmware before 3.0.0.4.380.7378 allow JSONP Information Disclosure such as a network map...
CVE-2017-5892
ASUS RT-AC and RT-N devices with firmware before 3.0.0.4.380.7378 allow JSONP Information Disclosure such as a network map...
CVE-2017-8877
ASUS RT-AC and RT-N devices with firmware through 3.0.0.4.380.7378 allow JSONP Information Disclosure such as the SSID...
CVE-2017-8877
ASUS RT-AC * and RT-N * router devices are affected by a JSONP Information Disclosure vulnerability in firmware versions through 3.0.0.4.380.7378 . An attacker can exploit this flaw to obtain sensitive information, such as the SSID . No specific exploit details or remediation steps are provided i...
CVE-2017-5892
ASUS RT-AC* and RT-N* routers with firmware older than 3.0.0.4.380.7378 expose a JSONP information-disclosure flaw that can reveal router data such as a network map. The vulnerability is covered by CVE-2017-5892. Most CSRF-related issues were fixed in firmware 3.0.0.4.380.7378; the JSONP informat...
CVE-2017-8877: Exposure of Sensitive Information to an Unauthorized Actor
ASUS RT-AC and RT-N devices with firmware through 3.0.0.4.380.7378 allow JSONP Information Disclosure such as the SSID...
CVE-2017-5892: Exposure of Sensitive Information to an Unauthorized Actor
ASUS RT-AC and RT-N devices with firmware before 3.0.0.4.380.7378 allow JSONP Information Disclosure such as a network map...
Cross-site Request Forgery (CSRF)
github.com/ant0ine/go-json-rest is vulnerable to cross-site request forgery. A malicious user can communicate with an JSONP endpoint using a SWF OBJECT to bypass the Same Origin Policy...
HackerOne: Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONP
Hi, I just discovered that there's a scenario where the Marketo Forms solution being used on www.hackerone.com can actually be abused, using a few fun techniques, to trigger an XSS in the Cross-Origin-iframe being used by Marketo. This results in eavesdropping of the data being sent in the...
langrenn.njaard.no XSS vulnerability
Vulnerable URL: http://langrenn.njaard.no/Sponsor/get?placeHolder=5=200000195=1896=0=0=prompt/OPENBUGBOUNTY/...