Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Non Persistent XSS. Show all posts
XSS Vulnerability
Breaking News Hacking News IT Security News Non Persistent XSS Vulnerability XSS Vulnerability

Non Persistent Cross Site scripting vulnerability in Monster India, Gulf and Hong Kong


A security Researcher Shikhil Sharma has identified a Non persistent Cross Site scripting vulnerability in one of the Leading online jobs search portal, Monster.

Monster is the largest job search engine in the world. Monster has over a million job postings at any time and over 1 million resumes, in the database (2008) and over 63 million job seekers per month. The company employs approximately 5,000 employees in 36 countries.

The Job search field in the Monster India website(jobsearch.monsterindia.com) is found to be vulnerable to the XSS injection.


POC:
http://jobsearch.monsterindia.com/searchresult.html?fts='/><script>alert('E+Hacking+News')</script>&x=0&y=0&mne=&mxe=
The same vulnerability affects the Hong Kong(jobsearch.monster.com.hk) and Gulf(jobsearch.monstergulf.com) branch of the Monster job portal.
Read more »
XSS Vulnerability
Breaking News Hacking News Non Persistent XSS Vulnerability XSS Vulnerability

000webhost vulnerable to Non-Persistent Cross site scripting


One of the Top free web hosting provider, 000WebHost website is found to be vulnerable to Cross site scripting .  The vulnerability was discovered by the Cyber Security Researcher  Vedachala.

Domain name,Subdomain name and email address field in "Order Free Web Hosting" page of the site (000webhost.com) are vulnerable to xss injection.


The web app developer of this site fails to validate those inputs for the special characters that results in this security flaw.

POC code for this security bug:

    http://www.000webhost.com/order.php?domain=\"><script>alert(/e hacking news/)</script>&subdomain=\"><script>alert(/e hacking news/)</scrip&name=\"><script>alert(/E Hacking News/)</script>&email=\"><script>alert(/e hacking news/)</script>&pass1=\"><script>alert(/E Hacking New&pass2=\"><script>alert(/E Hacking New&aggree=yes&error_multiple=1&error_domain=1&error_subdomain=1&error_name=&error_email=1&error_pass=4&error_tos=&error_number=&error_js=&error_disposable=&error_bad_gmail=

The researcher also recently found a reflected xss vulnerability in the Airtel website. 
Read more »
XSS Vulnerability
Breaking News Cyber Security News hacker news Non Persistent XSS Vulnerability XSS Vulnerability

WhatsApp website vulnerable to XSS Security flaw

An Information Security Expert, Narendra Chavda From Ahmedabad Gujarat, has discovered a non-persistent XSS security flaw in the official website of WhatsApp.

Narendra found that the Search Query field in the FAQ webpage of the whatsapp.com is vulnerable to  XSS attack.


When an attacker visits "www.whatsapp.com/faq/" and enter the xss code in the field , it successfully executes the entered script.

 POC code :
www.whatsapp.com/faq/search/?q=<script>alert("E Hacking News")</script>
The site also allows users to inject the iframe code:
http://www.whatsapp.com/faq/search/?q=<iframe src="http://www.ehackingnews.com/"height="1000px"width="1000px">
Read more »
Vulnerability
Breaking News Cyber Security News hacker news Non Persistent XSS Rafay Baloch Vulnerability

Rafay Baloch found Non-persistent XSS vulnerability in Mcafee and Symantec


A Security Researcher and Bug Hunter , Rafay Baloch has discovered a Non-Persistent Cross Site Scripting vulnerability in the websites belong to Internet Security giants : Mcafee and Symantec.

The download parameter in the Product Advisory Council sub-domain of McAfee(portal.mcafee.com) is found to be vulnerable to xss attack.

Researcher claimed that he notified McAfee about the xss vulnerability several times but they refused to fix.

McAfee xss


Reflected xss in Symantec

Few weeks before, he discovered xss in Storage Foundation DocCentral sub domain of Symantec(sfdoccentral.symantec.com) and sent notification to them. Symantec immediately fixed the vulnerability but McAfee fails to.

At the time of writing, The vulnerability is not yet patched.
Read more »
Subscribe to: Posts (Atom)