mozilla -- multiple vulnerabilities

Mozilla Foundation reports: CVE-2017-7828: Use-after-free of PressShell while restyling layout CVE-2017-7830: Cross-origin URL information leak through Resource Timing API CVE-2017-7831: Information disclosure of exposed properties on JavaScript proxy objects CVE-2017-7832: Domain spoofing throug...

Mail.ru: Self-xss via drag&drop in email form

User-assisted XSS in message composer's drag-n-drop feature via alt property of emoji-style image...

Shopify: Self-XSS in password reset functionality

Hi, When I opened this domain of yours, https://accounts.shopify.com/password-reset/new I just put the following text into email address box, [email protected] it change the colour of the text. Well my point here is that if you could inject HTML, you might be able to add a tag to the page. I...

Mail.ru: Stored self-XSS pubg.mail.ru в нескольких местах

Stored self-XSS in pubg.mail.ru via account name if login via social network is used. pubg.mail.ru is not currently in bug bounty scope...

VK.com: Хранимая XSS на странице "Виджет для авторизации"

Self-XSS на странице документации виджета. На счет того Self-XSS это или нет - оставляю на усмотрение общественности. Но лично мое мнение - команда vk тут все же ошибается. Для эксплуатации уязвимости атакующий должен был: Создать приложение с именем javascript:alert1;// Добавить атакуемого...

Mail.ru: XSS в портальной навигации

Stored self-XSS in portal navigation via external account name...

Weblate: Self-XSS can be achieved in the editor link using filter bypass

Description I saw the fixed issue in the https://hackerone.com/reports/223692 and i think i found another filter bypass. I noticed that we actually can use special keywords like %branchs, %files and %lines. So XSS can be achieved in this way: %branchs:alert1;//https:// if the branch will be named...

Quora: self xss in

Hi Quora security team, there is self XSS vulnerability in https://www.quora.com/profile/Username/ Steps: copy and paste the link in chrome browser copy entire link within double quotes "javascript:alertdocument.domain//https://www.quora.com/profile/Username/" then XSS payload will trigger please...

Mail.ru: Xss в https://e.mail.ru/

Приветствую , Я нашел xss на https://e.mail.ru/ , похоже, это self-xss, но, возможно,в будущем вы будите планировать расшаривать данную функциональность и это будет не self-xss, в том числе комбинация csrf logout/csrf login может расширить её функционал. Алсо, эта self-xss обходит текущие правила...

Mail.ru: Xss в https://e.mail.ru/

Привет, Я обнаружил xss на https://e.mail.ru/ , похоже, это self-xss, но вдруг в будущем планируется возможность расшаривать данную функциональность и это будет не self-xss, также атака csrf logout/csrf login может расширить её функционал. В том числе, это self-xss обходит текущие правила CSP. Дл...

WordPress: Self-XSS in WordPress Editor Link Modal

A self-xss was found in the link modal of the WordPress editor and fixed in the WordPress 4.8.2 release. Was a self-xss on the link modal and the WordPress team were very helpful and they made a patch for the bug happy to work with them :...

Weblate: Self XSS at translation page through Editor Link at demo.weblate.org

User input is not sanitized properly at Editor link causing self xss. Steps to reproduce 1 Navigate to https://demo.weblate.org/accounts/profile/preferences 2 Provide Editor link as javaScript:alertdocument.cookie;//confirm1; and click on Save 3 Navigate to English Translation page of the project...

Mail.ru: Stored XSS

Clickjacking and self-XSS in http://whiskas.ny.mail.ru/. This project is not currently in the bug bounty scope. I've found a Stored Self-XSS and turned it to be exploitable through Clickjacking...

HackerOne: IE 11 Self-XSS on Jira Integration Preview Base Link

I wasn't sure if you would accept this report due to it being Self-XSS, but I figured it might be useful information because it breaks one of the flows used to validate URLs. Steps ==================== 1. Launch IE 11 2. Log into a HackerOne account that has admin on a program. 3. Go to the...

Trello: The contact page is vulnerable to self-XSS via upload file name

https://trello.com/contact?nosearch=1&source=from%20helpsite%20beacon Save a file name as an XSS payload ; " . jpg It can only be done in linux because you cant rename a file as a payload in windows Click it and an xss will popup...

Revive Adserver: Reflected XSS on Zones > Invocation Code

"Cricetinae" : This report is similar to my earlier report: 170156. Short Description The Close text parameter in Inventory Zone Invocation Code is vulnerable to Cross-Site Scripting vulnerability. Steps to Reproduce 1. Logon or Work as an agent. 2. Navigate to Inventory Zones Invocation Code...

LocalTapiola: Reflected XSS in LTContactFormReceiver (/cs/Satellite)

URL: http://www.lahitapiola.fi/cs/Satellite POST: pagename=LahiTapiola/LTContactFormReceiver &formId=1310385477986 &campaignID= &lotteryIDList=1 &soaperrorMessage= &soapServerErrorMessage= &acceptTermsErrorMessage= &radioErrorMessage= &dropdownErrorMessage= &constraintErrorMessage=...

HackerOne: (HackerOne SSO-SAML) Login CSRF, Open Redirect, and Self-XSS Possible Exploitation

Summary: Login CSRF, Open Redirect, and Self-XSS Possible Exploitation through HackerOne SSO-SAML PoC - Go to █████; Use a browser window with clear cookies. Source-code: setTimeoutfunctiondocument.location.href = "https://hackerone.com/users/saml/signin?email=████&rememberme=true";, 5000; Impact...

Yelp: Self-XSS via location cookie city field when getting suggestions for a new location

Hi, Only self-XSS, but thought I would report it anyway! I noticed the cookie "location" had some JSON in it, so I changed the city field to debugger, made sure it was encoded the same, then went to add a new location/change an existing location at https://www.yelp.com/profilelocation. Making sur...

Nextcloud: Reflected Self-XSS Vulnerability in the Comment section of Files (Different-payloads)

Note::steps mentioned in report164027 In the Comments Box,the payload to execute XSS is passed. Test Payloads: alert1 Also the above payload is still working.. Also try this payload " fooalert1 Click edit comment after posted. XSS Triggers...