568 matches found
CVE-2020-10114
cPanel before 84.0.20 allows stored self-XSS via the HTML file editor SEC-535...
CVE-2020-10114
CVE-2020-10114 affects cPanel prior to 84.0.20. The vulnerability is described as a stored self‑XSS via the HTML file editor (SEC-535). The connected documents do not provide additional technical details such as affected components beyond the editor, exploit vectors, or concrete remediation steps...
CVE-2020-10113
cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...
CVE-2019-20493
CVE-2019-20493 affects cPanel prior to 82.0.18. The vulnerability is a self‑XSS caused by mishandled JSON string escaping (SEC-520). Exploitation would require user interaction and can originate from a network context, with a CVSS3.1 base score of 6.1 (MEDIUM) and CVSS2 score of 4.3 (MEDIUM) as d...
CVE-2019-20493
cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled SEC-520...
CVE-2020-9007
Codoforum 4.8.8 allows self-XSS via the title of a new topic...
CVE-2020-9007
Codoforum 4.8.8 allows self-XSS via the title of a new topic...
Design/Logic Flaw
Codoforum 4.8.8 allows self-XSS via the title of a new topic...
CVE-2020-9007
CVE-2020-9007 affects Codoforum 4.8.8. The issue is a self-XSS vulnerability in the title of a new topic, stemming from insufficient validation of client-side data by the web application (CNVD/CVEs describe it as a cross-site scripting flaw). Practical impact is client-side code execution within ...
CVE-2020-9007
Codoforum 4.8.8 allows self-XSS via the title of a new topic...
Mail.ru: Self XSS via help.mail.ru interface
Self-XSS in sandbox domain via support chat interface on help.mail.ru with no security impact identified...
berniegrantcentre.co.uk Cross Site Scripting vulnerability
Security Researcher geeknik Helped patch 8525 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting berniegrantcentre.co.uk website and its users. Following...
Pornhub: Self-XSS to Good-XSS - pornhub.com
The researcher was able to bypass the site-wide clickjacking protection X-Frame-Options header in order to fully automate the exploitation of a self-xss vulnerability, allowing attackers to execute arbitrary javascript payloads on the pornhub domain through iframes hosted on a third-party website...
Shopify: Stored XSS in Shopify Chat
1.install app Shopify Chat 2.Click chat on the shop homepage or Shopify Ping to send poc javascript:alert1//https://dqdqdqdqdq.myshopify.com 3.Click url, alert F657395 Impact 1.Front end user Self-XSS 2.Administrator XSS foreground user...
Shopify: Timeline Editor Self-XSS (Previous Fix #738072 Incomplete)
1.Consistent steps 2.poc: axxx 3. F656339 Impact admin...
CVE-2019-17405
Nokia IMPACT 18A: has Reflected self XSS...
Cross site scripting
Nokia IMPACT 18A: has Reflected self XSS...
CVE-2019-17405
Nokia IMPACT 18A: has Reflected self XSS...
Radancy: 'X-Forwarded-Host' key used in input without sanitation - possible cache poisoning
Domain and URL: maximum.nl Summary: The HTTP 'X-Forwarded-Host' is dynamically used in the application without sanitization, allowing an attacker control of the input key. This can allow for self-XSS, or when a CDN or caching service is deployed, risk the CDN caching the request and serving the...