CVE-2017-7839

Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting self-XSS attacks where users are...

Cross-site Scripting (XSS)

symphonycms/symphony-2 is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of the page title parameter, allowing self XSS attacks to occur...

Moodle 3.x Multiple Vulnerabilities (Sep 2017) - Windows

Moodle CMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...

Moodle 3.x Multiple Vulnerabilities (Sep 2017) - Linux

Moodle CMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...

Imgur: CSRF leads to a stored self xss

Followup from 311460 Summary Self xss and CSRF are both out of scope, but when paired it is possible to create an attack on a user. Description A favorites folder with an xss payload for a name will launch when saving an image to said folder. This can be verified by following these steps Visit yo...

Fedora 26 : php-phpmyadmin-motranslator / php-phpmyadmin-sql-parser / etc (2018-147d33439c)

From upstream announcement : Security fix: phpMyAdmin 4.7.8 is released Welcome to phpMyAdmin 4.7.8, a security releaes also containing regular maintenance bug fixes. The security fix relates to a self-XSS vulnerability in the central columns feature that is reported as PMASA-2018-1...

Fedora 27 : php-phpmyadmin-motranslator / php-phpmyadmin-sql-parser / etc (2018-a1650ed14f)

From upstream announcement : Security fix: phpMyAdmin 4.7.8 is released Welcome to phpMyAdmin 4.7.8, a security releaes also containing regular maintenance bug fixes. The security fix relates to a self-XSS vulnerability in the central columns feature that is reported as PMASA-2018-1...

Self XSS in central columns feature

PMASA-2018-1 Announcement-ID: PMASA-2018-1 Date: 2018-02-20 Summary Self XSS in central columns feature Description A self-cross site scripting XSS vulnerability has been reported relating to the central columns feature. Severity We consider this vulnerability to be of moderate severity. Mitigati...

Self Cross-site Scripting (XSS)

concrete5 is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the user input for the saved search, allowing a malicious user to trick another user into performing a self XSS attack...

VK.com: self-xss ads_easy_promote vk.com

Self-XSS в рекламе...

VK.com: XSS работающая по всему сайту, где есть упоминания

Self-XSS в упоминаниях...

mozilla -- multiple vulnerabilities

Mozilla Foundation reports: CVE-2017-7828: Use-after-free of PressShell while restyling layout CVE-2017-7830: Cross-origin URL information leak through Resource Timing API CVE-2017-7831: Information disclosure of exposed properties on JavaScript proxy objects CVE-2017-7832: Domain spoofing throug...

Mail.ru: Self-xss via drag&drop in email form

User-assisted XSS in message composer's drag-n-drop feature via alt property of emoji-style image...

Shopify: Self-XSS in password reset functionality

Hi, When I opened this domain of yours, https://accounts.shopify.com/password-reset/new I just put the following text into email address box, [email protected] it change the colour of the text. Well my point here is that if you could inject HTML, you might be able to add a tag to the page. I...

Mail.ru: Stored self-XSS pubg.mail.ru в нескольких местах

Stored self-XSS in pubg.mail.ru via account name if login via social network is used. pubg.mail.ru is not currently in bug bounty scope...

VK.com: Хранимая XSS на странице "Виджет для авторизации"

Self-XSS на странице документации виджета. На счет того Self-XSS это или нет - оставляю на усмотрение общественности. Но лично мое мнение - команда vk тут все же ошибается. Для эксплуатации уязвимости атакующий должен был: Создать приложение с именем javascript:alert1;// Добавить атакуемого...

Mail.ru: XSS в портальной навигации

Stored self-XSS in portal navigation via external account name...

Weblate: Self-XSS can be achieved in the editor link using filter bypass

Description I saw the fixed issue in the https://hackerone.com/reports/223692 and i think i found another filter bypass. I noticed that we actually can use special keywords like %branchs, %files and %lines. So XSS can be achieved in this way: %branchs:alert1;//https:// if the branch will be named...

Quora: self xss in

Hi Quora security team, there is self XSS vulnerability in https://www.quora.com/profile/Username/ Steps: copy and paste the link in chrome browser copy entire link within double quotes "javascript:alertdocument.domain//https://www.quora.com/profile/Username/" then XSS payload will trigger please...

Mail.ru: Xss в https://e.mail.ru/

Приветствую , Я нашел xss на https://e.mail.ru/ , похоже, это self-xss, но, возможно,в будущем вы будите планировать расшаривать данную функциональность и это будет не self-xss, в том числе комбинация csrf logout/csrf login может расширить её функционал. Алсо, эта self-xss обходит текущие правила...