Zendesk: a stored xss in web widget chat

The researcher found a stored XSS vulnerability where an end-user was able to execute arbitrary Javascript against the Zendesk agent via the chat integration. The researcher participated in the Zendesk 2016 holiday promotion and was awarded the Zendesk promotional bounty...

Shopify: XSS in my.shopify.com in widget

Hi security team I found XSS in the Buy Button in my.shopify.com Step to reproduce 1-Go to Product and create Product with these payload ; See Step1 2- Now Go to Embed on a website and in the buy bouton page chose the third template and XSS will pop up Patch it...

pro.iconosquare.com XSS vulnerability

Vulnerable URL: https://pro.iconosquare.com/widget/gallery?width=";%3E%3Csvg/onload=alert'OPENBUGBOUNTY'// Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated V...

Alienvault OSSIM/USM 5.3.1 - PHP Object Injection Vulnerability

Exploit for php platform in category web applications Details ======= Product: Alienvault OSSIM/USM Vulnerability: PHP Object Injection Author: Peter Lapp, lappsec gmail com CVE: CVE-2016-8580 Vulnerable Versions: =5.3.1 Fixed Version: 5.3.2 Vulnerability Details ===================== A PHP objec...

Alienvault OSSIM/USM 5.3.1 PHP Object Injection

Details ======= Product: Alienvault OSSIM/USM Vulnerability: PHP Object Injection Author: Peter Lapp, lappsec gmail com CVE: CVE-2016-8580 Vulnerable Versions: =5.3.1 Fixed Version: 5.3.2 Vulnerability Details ===================== A PHP object injection vulnerability exists in multiple widget...

Alienvault OSSIMUSM 5.3.1 - PHP Object Injection

Alienvault OSSIMUSM 5.3.1 - PHP Object Injection Details ======= Product: Alienvault OSSIM/USM Vulnerability: PHP Object Injection Author: Peter Lapp, lappsec gmail com CVE: CVE-2016-8580 Vulnerable Versions: =5.3.1 Fixed Version: 5.3.2 Vulnerability Details ===================== A PHP object...

Alienvault OSSIM/USM 5.3.1 - PHP Object Injection

Details ======= Product: Alienvault OSSIM/USM Vulnerability: PHP Object Injection Author: Peter Lapp, lappsec gmail com CVE: CVE-2016-8580 Vulnerable Versions: =5.3.1 Fixed Version: 5.3.2 Vulnerability Details ===================== A PHP object injection vulnerability exists in multiple widget...

CVE-2016-8580

PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2. These vulnerabilities allow arbitrary PHP code execution via magic methods in included classes...

chat.mirrorbingo.com XSS vulnerability

Vulnerable URL: https://chat.mirrorbingo.com/chatweb/conf/trinitymirrortrinitymirror/widget?lang=%27/prompt%28%27OPENBUGBOUNTY%27%29/%27 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VI...

Coinbase: Information disclosure of user by email using buy widget

In the Coinbase Buy Widget flow, we were displaying the last 4 digits of a user's phone number for verification purposes e.g. "we've send a code to xxx-1234". Industry standard seems to be 2 digits instead of 4, so we now mask all but the last 2 digits...

PT-2020-6949 · Zabbix +4 · Zabbix +4

Name of the Vulnerable Software and Affected Versions: Zabbix versions 3.0.0 through 3.0.32rc1 Zabbix versions 4.0.0 through 4.0.22rc1 Zabbix versions 4.1.x through 4.4.x before 4.4.10rc1 Zabbix versions 5.x before 5.0.2rc1 Description: The issue is related to the lack of protection of the web pa...

chromium-browser: universal xss in blink

Cross-site scripting XSS vulnerability in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to inject arbitrary web script or HTML via vectors related to widget updates, aka "Universal XSS UXSS."...

CVE-2016-5148

Cross-site scripting XSS vulnerability in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to inject arbitrary web script or HTML via vectors related to widget updates, aka "Universal XSS UXSS."...

Cross site scripting

Cross-site scripting XSS vulnerability in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to inject arbitrary web script or HTML via vectors related to widget updates, aka "Universal XSS UXSS."...

Calendar Widget: Month - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Calendar Widget: Month published at the 'play' market has multiple vulnerabilities...

UBUNTU-CVE-2016-5148

Cross-site scripting XSS vulnerability in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to inject arbitrary web script or HTML via vectors related to widget updates, aka "Universal XSS UXSS."...

CVE-2016-5148

Cross-site scripting XSS vulnerability in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to inject arbitrary web script or HTML via vectors related to widget updates, aka "Universal XSS UXSS."...

zomato.com XSS vulnerability

Vulnerable URL: https://www.zomato.com/widgets/urbanspoonmigratedwidgets.php?case=olikeitresid=17467370"'/;a=eval;b=alert;ab/XSSPOSED/;...

URL Widget - Customized SSL, External URLs, KeyStore usage vulnerabilities

HackApp vulnerability scanner discovered that application URL Widget published at the 'play' market has multiple vulnerabilities...

meteo.be XSS vulnerability

Vulnerable URL: http://www.meteo.be/services/widget/?postcode=1180famfp"prpkn=2=10〈=fr Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 18134 VIP website status:| Yes Check meteo.be...