Full Disclosure mailing list archives
Serena Business Manager < 10.01 DOM XSS Vulnerability
From: Cosmin Maier <cosmin () zeroday pro>
Date: Thu, 11 Feb 2016 23:12:54 +0200
# Exploit Title: Serena Business Manager < 10.01 DOM XSS Vulnerability # Date: 11-feb-16 # Exploit Author: Zeroday.pro Labs # Software Link: https://www.serena.com/index.php/en/products/it-process-portal-management/sbm/overview/ # Version: Tested and working on 10.01.04.01.1068 (build 10) Serena Business Manager is vulnerable to a DOM cross-site scripting (XSS) attack. The attack allows execution of arbitrary JavaScript in the context of the user’s browser. Vulnerability resides in source location.href at tmtrack.dll and sink jQuery.html Example: The SBM User Workspace cannot be embedded in another frame.<br><a href=http://link/tmtrack/tmtrack.dll target=_new>1337</a>
_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Serena Business Manager < 10.01 DOM XSS Vulnerability Cosmin Maier (Feb 12)