HackerOne: Stored XSS on https://events.hackerone.com

@nagli found a stored Cross-Site Scripting vulnerability in a 3rd party vendor that was used by HackerOne. This system did not contain any data related to reports submitted and stored on hackerone.com. HackerOne worked with the vendor to remediate the vulnerability. The report is partially...

cPanel cross-site scripting vulnerability (CNVD-2020-55180)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in cPanel versions prior to 90.0.10, which stems from allowing SELF XSS via the Cron...

CVE-2020-26113

cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces SEC-569...

CVE-2020-26110

cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces SEC-564...

CVE-2020-26111

cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface SEC-566...

CVE-2020-26111

cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface SEC-566...

CVE-2020-26113

cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces SEC-569...

CVE-2020-26114

cPanel before 90.0.10 allows self XSS via the Cron Jobs interface SEC-573...

Design/Logic Flaw

cPanel before 90.0.10 allows self XSS via the Cron Editor interface SEC-574...

Design/Logic Flaw

cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces SEC-569...

Design/Logic Flaw

cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces SEC-564...

Design/Logic Flaw

cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface SEC-566...

Design/Logic Flaw

cPanel before 90.0.10 allows self XSS via the Cron Jobs interface SEC-573...

CVE-2020-26110

cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces SEC-564...

CVE-2020-26111

cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface SEC-566...

CVE-2020-26111

CVE-2020-26111 affects cPanel prior to 90.0.10. The vulnerability is a self XSS in the WHM Edit DNS Zone interface (SEC-566). Impact described as partial integrity risk with low confidentiality/low integrity and no availability impact in CVSS 3.1 (base score 6.1; UI required; network vector; chan...

CVE-2020-26113

CVE-2020-26113 affects cPanel before 90.0.10, with a self XSS vulnerability in the WHM Manage API Tokens interfaces (SEC-569). The weakness allows execution of client‑side code via token management UI, enabling a logged‑in attacker to potentially compromise session integrity. Public references co...

CVE-2020-26114

cPanel before 90.0.10 allows self XSS via the Cron Jobs interface SEC-573...

Shopify: Self XSS

I have found self xss in myshopify.com/admin/apps/import-store/ POC 1 - Go to yourstore.myshopify.com 2 - Go to settings App - Import maybe ask you for your platform select any one 3 - Upload file csv with file name payload xss " Impact XSS Attack...

Rocket.Chat: Session Hijack via Self-XSS

Summary: It's possible to hijack a session by tricking the user to perform a Self-XSS on the drag and drop functionality in the chat. Description: Self-XSS is an underrated vulnerability that can have a harmful impact on the users of the application like here, after we get access to the user's...