Collaborate Disseminate
A security researcher has discovered a jQuery File Upload Plugin Zero-Day Vulnerability that allows hackers to abuse thousands of sites. The flaw was announced to the public alongside the fact that this plugin as adopted by many services and platforms…. Continue reading CVE-2018-9206: jQuery File Upload Plugin Zero-Day Vulnerability Affects Thousands of Sites
When we make a call with ajax it is open at the client end and it works like a charm but the problem is website security. Do we have any particular technique to make ajax calls secure so that hacker cannot attack our site?
How can i block tag style inside iframe?
I have an iframe website when it is starting the document iframe append it.
How can i change the display property to intital?
<style
*{
display:none;
}
</style
Is it possible to screenshot the whole desktop of users visiting my website?
I am using the PHP function imagegrabscreen() but it’s only working on localhost. Is this done on the server or can I do this with WebRTC without a… Continue reading How can I screenshot the whole desktop?
I wrote a JQuery tool to preview images before uploads.
User A clicks the explore button to select an image
selects it
a change-event displays the image
If user A selects a prepared SVG image as “greetings_ILL_xss_your_s… Continue reading Are there XSS vulnerabilities while image preview before uploading it?
This is some vulnerable JavaScript code:
$(document).ready(function(){
var payload = unescape(document.location.hash.substr(1));
$(payload);
document.body.innerText = “The payload is: ” + payload;
});
When I tr… Continue reading Exploiting XSS in jQuery without equal character?
I have an api endpoint that returns a new api token in JSON to the user if they’re logged in to my website with only their session cookies being used to authenticate.
I’m trying to write a piece of code that automatically lo… Continue reading CSRF testing of an api endpoint using GET requests
I want to include a feature to add a sort function on an HTML table on my site, using the tablesorter library.
I would be using this on a part of the site that requires a login to access data. But I am worried the library mi… Continue reading How to audit JavaScript written by someone else before including it on my site?
Is it possible to exploit XSS in the following code?
jQuery(window.location.hash)
It seems to me that window.location.hash always starts with a hash #, and modern jQuery always interpretes this as an ID selector. Is this correct?
Continue reading Is XSS possible with jQuery(location.hash)?
I am working on an enterprise project and we have a upcoming new release. The security team runs a security scan, in that vulnerability report there is one point that I am struggling with. The project uses jQuery 1.4.x and it… Continue reading Is there a base version of jQuery which has no XSS vulnerability?