2475 matches found
Cross-site Scripting (XSS)
modx/revolution is vulnerable to cross-site scripting XSS. The attack is possible because it does not sanitize user photo field, allowing the attacker to inject malicious script through it...
X (Formerly Twitter): Stored XSS on reports.
Summary: Stored XSS can be submitted on reports, and anyone who will check the report the XSS will trigger. Description: Stored XSS, also known as persistent XSS, is the more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application...
CVE-2019-0017: Unrestricted Upload of File with Dangerous Type
The Junos Space application, which allows Device Image files to be uploaded, has insufficient validity checking which may allow uploading of malicious images or scripts, or other content types. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1...
CVE-2018-1000874
PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in all distributed parsers allowing a malicious crafted script to be executed that can result in the lose of user data and sensitive user information. This attack can be exploited by crafting a...
StatCounter Analytics Code Hijacked to Steal Bitcoins from Cryptocurrency Users
Late last week an unknown hacker or a group of hackers successfully targeted a cryptocurrency exchange with an aim to steal Bitcoins by compromising the web analytics service it was using. ESET malware researcher Matthieu Faou this weekend spotted malicious JavaScript code on up to 700,000 websit...
StatCounter Analytics Code Hijacked to Steal Bitcoins from Cryptocurrency Users
Late last week an unknown hacker or a group of hackers successfully targeted a cryptocurrency exchange with an aim to steal Bitcoins by compromising the web analytics service it was using. ESET malware researcher Matthieu Faou this weekend spotted malicious JavaScript code on up to 700,000 websit...
Frida-Wshook - Script Analysis Tool Based On Frida.re
frida-wshook is an analysis and instrumentation tool which uses frida.re to hook common functions often used by malicious script files which are run using WScript/CScript. The tool intercepts Windows API functions and doesn't implement function stubs or proxies within the targeted scripting...
malayalam.filmibeat.com XSS vulnerability
Open Bug Bounty ID: OBB-687350 Description| Value ---|--- Affected Website:| malayalam.filmibeat.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...
rusdate.de XSS vulnerability
Open Bug Bounty ID: OBB-684843 Description| Value ---|--- Affected Website:| rusdate.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Buggy implementation of CVE-2018-8373 vulnerability used to deliver Quasar RAT
A variant of a remote code execution vulnerability with Internet Explorer's scripting engine known as CVE-2018-8373 patched last August has been found in the wild. Looking at the IOCs posted by our colleagues at TrendMicro, we recognized the infrastructure serving this exploit. The same static...
Dell EMC Unity Cross-Site Scripting Vulnerability
Dell EMC Unity is a fully unified storage array designed for flash storage. A cross-site scripting vulnerability exists in Dell EMC Unity, which can be exploited by a remote, unauthenticated attacker to serve malicious HTML or Java script code to Unisphere by tricking the user of the victim's...
Qibo B2B E-commerce System Stored Cross-site Scripting Vulnerability
Qibo B2B e-commerce system is based on PHP programs and Mysql database-based open source B2B industry portal e-commerce website builder . Qibo B2B e-commerce system stored cross-site scripting vulnerabilities. Attackers can insert malicious js code in the page to obtain user cookies and other...
Cross-Site Scripting (XSS)
Kentico is vulnerable to cross-site scripting XSS. The vulnerability exists because user-provided input is not escaped properly, allowing to inject a malicious script to the system page...
CVE-2018-14777
An issue was discovered in DataLife Engine DLE through 13.0. An attacker can use XSS related to the /addnews.html and /index.php?do=addnews URIs to send a malicious script to unsuspecting Admins or users...
CVE-2018-14777: Improper Neutralization of Input During Web Page Generation
An issue was discovered in DataLife Engine DLE through 13.0. An attacker can use XSS related to the /addnews.html and /index.php?do=addnews URIs to send a malicious script to unsuspecting Admins or users...
Chaturbate: Homograph attack on redirect URL
Hello Team There is no Homography protection on redirect URL URL: https://m.chaturbate.com/externallink/?url=http://ebаy.com In Homograph attack basically attacker may able to inject some malicious script with URL. Here i made homograph link for the ebay.com, when normal user see this link its lo...
Chaturbate: Homograph attack on redirect URL (https://chaturbate.com/external_link/?url)
Hi There, Hope you are doing good, As i was just playing around with chaturbate.com and found that you guys does not have proper configuration for malicious script injection in website. In Homograph attack basically attacker may able to inject some malicious script with URL. Here i made homograph...
Adobe Systems - Arbitrary Code Injection Vulnerability
Document Title: =============== Adobe Systems - Arbitrary Code Injection Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2120 PSIRT ID: 7873 Vulnerability Magazine:...
Trello: Stored XSS via Chrome plugin
Stored XSS via Chrome plugin 1. Install the Trello Chrome plugin 2. Create a list on trello.com with a script injection title eg "alert'xss';" 3. Open the Chrome plugin and browse to the list, the code is executed from the plugin I've attached screenshots of the problem The origin is the chrome...