HackerOne: IE 11 Self-XSS on Jira Integration Preview Base Link

I wasn't sure if you would accept this report due to it being Self-XSS, but I figured it might be useful information because it breaks one of the flows used to validate URLs. Steps ==================== 1. Launch IE 11 2. Log into a HackerOne account that has admin on a program. 3. Go to the...

Trello: The contact page is vulnerable to self-XSS via upload file name

https://trello.com/contact?nosearch=1&source=from%20helpsite%20beacon Save a file name as an XSS payload ; " . jpg It can only be done in linux because you cant rename a file as a payload in windows Click it and an xss will popup...

Revive Adserver: Reflected XSS on Zones > Invocation Code

"Cricetinae" : This report is similar to my earlier report: 170156. Short Description The Close text parameter in Inventory Zone Invocation Code is vulnerable to Cross-Site Scripting vulnerability. Steps to Reproduce 1. Logon or Work as an agent. 2. Navigate to Inventory Zones Invocation Code...

LocalTapiola: Reflected XSS in LTContactFormReceiver (/cs/Satellite)

URL: http://www.lahitapiola.fi/cs/Satellite POST: pagename=LahiTapiola/LTContactFormReceiver &formId=1310385477986 &campaignID= &lotteryIDList=1 &soaperrorMessage= &soapServerErrorMessage= &acceptTermsErrorMessage= &radioErrorMessage= &dropdownErrorMessage= &constraintErrorMessage=...

HackerOne: (HackerOne SSO-SAML) Login CSRF, Open Redirect, and Self-XSS Possible Exploitation

Summary: Login CSRF, Open Redirect, and Self-XSS Possible Exploitation through HackerOne SSO-SAML PoC - Go to █████; Use a browser window with clear cookies. Source-code: setTimeoutfunctiondocument.location.href = "https://hackerone.com/users/saml/signin?email=████&rememberme=true";, 5000; Impact...

Yelp: Self-XSS via location cookie city field when getting suggestions for a new location

Hi, Only self-XSS, but thought I would report it anyway! I noticed the cookie "location" had some JSON in it, so I changed the city field to debugger, made sure it was encoded the same, then went to add a new location/change an existing location at https://www.yelp.com/profilelocation. Making sur...

Nextcloud: Reflected Self-XSS Vulnerability in the Comment section of Files (Different-payloads)

Note::steps mentioned in report164027 In the Comments Box,the payload to execute XSS is passed. Test Payloads: alert1 Also the above payload is still working.. Also try this payload " fooalert1 Click edit comment after posted. XSS Triggers...

Ian Dunn: stored SELF xss on Basic Google Maps Placemarks Settings plugin

Hi Ian, I have to say, normally I don't report and vendors doesn't accept self xss vulnerabilities as valid, but I'm encouraged by 9375 So, I'm reporting this. Placemark title field is NOT sanitizing the user input properly. I've updated wordpress to latest, and checked your plugin's versiyon fro...

Ian Dunn: Multiple XSS in Camptix Event Ticketing Plugin

Hi, As discussed in 151561 submitting the report here. I have got some more bugs in Camptix Event Ticketing plugin. Well, the first one is a ticket page xss caused by the Ticket Title And the second one is kind of self-xss, caused by also the Ticket title of the plugin but in the coupons page. I...

Fedora 24 : phpMyAdmin (2016-e3240782ec)

phpMyAdmin 4.6.2 2016-05-25 ============================= - security User SQL queries can be revealed through URL GET parameters, see PMASA-2016-14 - security Self XSS vulneratbility, see PMASA-2016-16 - Use https for documentation links - Fix schema export with too many tables - Avoid parsing no...

openSUSE Security Update : phpMyAdmin (openSUSE-2016-712)

This phpMyAdmin update to version 4.4.15.6 fixes the following issues : Security issues fixed : - PMASA-2016-16 CVE-2016-5099, CWE-661: Self XSS, see https://www.phpmyadmin.net/security/PMASA-2016-16/ - PMASA-2016-15 CVE-2016-5098, CWE-661: File Traversal Protection Bypass on Error Reporting, see...

openSUSE Security Update : phpMyAdmin (openSUSE-2016-655)

phpMyAdmin was updated to fix one security issue. The following vulnerability was fixed : - CVE-2016-5099: Self XSS vulneratbility - A specially crafted attack could allow for special HTML characters to be passed as URL encoded values and displayed back as special characters in the page boo982128...

Uber: Self-XSS on partners.uber.com

Hi, I found a reflected XSS vulnerability in password reset page https://partners.uber.com/reset-password. I have tested this vulnerability in the latest Chrome and Firefox browsers. Reproduction Steps: 1- Go to https://login.uber.com/forgot-password and reset password. Then, Click password reset...

Uber: Stored self-XSS at m.uber.com

There is a stored self-XSS vulnerability at m.uber.com in displaying the uber invite code. If the user sets the invite code at alertdocument.domain value using the main personal area at the uber.com and then signs into the m.uber.com the XSS is fired. Possible other user exploitation case can be...

FreeBSD : py-djblets -- Self-XSS vulnerability (df328fac-f942-11e5-92ce-002590263bf5)

Djblets Release Notes reports : A recently-discovered vulnerability in the datagrid templates allows an attacker to generate a URL to any datagrid page containing malicious code in a column sorting value. If the user visits that URL and then clicks that column, the code will execute. The cause of...

Uber: Self-XSS Vulnerability on Password Reset Form

Hello Security Team, I have found Third Security Vulnerability on your website :- https://partners.uber.com/ Vulnerability :-"XSS vulnerability on password reset time :" My Payload is this :- '" Following This Reproduce Steps : 1 send password reset link on your email id 2 open password reset lin...

Slack: Reflected Self-XSS in Slack

Go to https://domainname.slack.com/services/new 2. In the searchbar, type an XSS payload I used 3. Hit Enter 4. XSS pop-up Thanks! I have provided POCs...

ownCloud: Self-XSS in mails sent by [email protected]

Hello i create account with username have a payload code "alert1, and i always when i get mail from [email protected] i get mail win inject the code payload html code inject From: ownCloud Reply-To: [email protected] To: [email protected] Message-ID: Subject: ownCloud Security & Encryption 2.0; A...

Slack: Self-XSS in posts by formatting text as code

Hi I have found an XSS in Slack. To reproduce the issue, just follow this: 1. Go to your Slack account accountname.slack.com 2. Below you will see a plus + sign, click that, there will be three options, click "Create Post" 3. You will be redirected to a page where you will create it. 4. Type the...

WordPress White-Label Framework 2.0.6 - XSS Vulnerability

安装好whitelable主题之后漏洞文件位置是: /whitelable-framework/inc/snippets/form-sharebymailiframe.php Line 48 50: $recipient = $POST'recipemail'; if stripos$recipient, ',' $recipient = substr$recipient, 0, stripos$recipient, ','; 可以看到这里POST方式接收到的recipemail只是去掉了逗号之后的内容然后就直接存入变量$recipient Line 86: Your Message h...