Khan Academy: Stored 'undefined' Cross-site Scripting

Hello KhanAcademy Security Team, I'm rootbakar, I found an XSS bug on 'BIO' in the profile, I used payload XSS "/load=promptdocument.domain;"/load= prompt document.cookie; after I save it appears there is no trigger from the XSS, but when I try to change one of the values in the profile form and...

epson.hr XSS vulnerability

Open Bug Bounty ID: OBB-665220 Description| Value ---|--- Affected Website:| epson.hr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Valve Patches Trivial XSS Bug in Steam

Valve Corp., has patched a cross-site scripting vulnerability on its popular Steam gaming platform that could be exploited by viewing a maliciously crafted profile. The flaw could allow an attacker to carry out phishing attacks or execute malicious scripts just by opening a crafted profile page. ...

trinketsandtrash.org XSS vulnerability

Vulnerable URL: https://trinketsandtrash.org/detail.php?itemnumber=213662'"--!...

Informatica: [careers.informatica.com] XSS on "isJTN"

hi , i found XSS bug on parameter "isJTN=" at careers.informatica.com give you ability to run java script code tested on firefox 50.0.2 also on old version of google chrome in the last version , but if try this bug in chrome last version you will got a source code displayed on page with out run c...

rugbyeurope.eu XSS vulnerability

Vulnerable URL: http://www.rugbyeurope.eu/search.php Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 23:15 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 586078 VIP website status:| No Check rugbyeurope.eu SS...

easyname.es XSS vulnerability

Vulnerable URL: https://www.easyname.es/en/domain/search?domain=...

VBScan 0.1.4 - Black Box vBulletin Vulnerability Scanner

VBScan is an opensource project in perl programming language to detect VBulletin CMS vulnerabilities and analyses them. Why VBScan ? If you want to do a penetration test on a vBulletin Forum, VBScan is Your best shot ever! This Project is being faster than ever and updated with the latest VBullet...

wiley.com XSS vulnerability

Vulnerable URL: http://www.wiley.com/WileyCDA/countryRedirect?-- Details: Description| Value ---|--- Patched:| Yes, at 01.09.2017 Latest check for patch:| 01.09.2017 09:59 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1044 Google Pagerank| 8 VIP website status...

u-20.ge XSS vulnerability

Vulnerable URL: http://www.u-20.ge/club.php?tmp=64'"/alert/xssposed/...

Mail.ru: [games.my.com] Reflected XSS

Browser-specific reflected XSS via URI parameters in games.my.com. games.my.com is not covered by bug bounty scope...

Popular WordPress SEO Plugin Fixes XSS Bug

The Yoast WordPress SEO plugin, which has been downloaded more than 14 million times, has a serious cross-site scripting vulnerability that can allow an attacker to force a vulnerable site to execute arbitrary HTML code. The bug may have been reported to the plugin’s developer as long as two year...

OkCupid: An XSS bug was fixed due to my report, but I didn't submit it through the h1

I wasn't notified of the security process, and received no bounty. On Jan 08, 2015 at 01:22AM UTC OkCupid User Feedback wrote: don't hover over this if you put this on your profile and they hover over it, they will "like" your profile this can be used to execute arbitrary clientside code...

XSS Vulnerability - delete filter confirmation

panel:bgColor=e7f4fa NOTE: This bug report is for JIRA Cloud. Using JIRA Server? See the corresponding bug report|http://jira.atlassian.com/browse/JRASERVER-34074. panel Similar to JRA-31564, an XSS bug exists in the delete filter success screen. Steps to reproduce: 1. Search for issues. 2. Choos...

XSS bug in detail view epic name lozenge rendering

6.1 introduced an xss bug in the detail view, more specifically in the epic field that displays to which epic an issue belongs to...

XSS bug in detail view epic name lozenge rendering

6.1 introduced an xss bug in the detail view, more specifically in the epic field that displays to which epic an issue belongs to...

XSS bug in detail view epic name lozenge rendering

6.1 introduced an xss bug in the detail view, more specifically in the epic field that displays to which epic an issue belongs to...

Persistent XSS Bug on Twitter Exploited by Worm

UPDATE— Within an hour of reports surfacing about a cross-site scripting bug on the Twitter home page, a worm exploiting the bug was released on the site. However, engineers at Twitter have repaired the bug and say that it no longer should be exploitable. The bug appeared Tuesday morning and...

The Week in Security: Gov2.0, DLL Patches and When Social Media Attacks!

Summer may have reached its unofficial end with the Labor Day holiday, but there was no break from security news this week, as both the Gov 2.0 Conference in Washington D.C. and a raft of warnings and patches from leading vendors kept the heat on high. We all know the Internet started as a U.S...

openSUSE 10 Security Update : tomcat55 (tomcat55-6369)

This update of tomcat fixes several vulnerabilities : - CVE-2008-5515: RequestDispatcher usage can lead to information leakage - CVE-2009-0033: denial of service via AJP connection - CVE-2009-0580: some authentication classes allow user enumeration - CVE-2009-0781: XSS bug in example application...