[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[FD] Serena Business Manager < 10.01 DOM XSS Vulnerability
- To: fulldisclosure@xxxxxxxxxxxx
- Subject: [FD] Serena Business Manager < 10.01 DOM XSS Vulnerability
- From: Cosmin Maier <cosmin@xxxxxxxxxxx>
- Date: Thu, 11 Feb 2016 23:12:54 +0200
>> # Exploit Title: Serena Business Manager < 10.01 DOM XSS Vulnerability
>> # Date: 11-feb-16
>> # Exploit Author: Zeroday.pro Labs
>> # Software Link:
>> https://www.serena.com/index.php/en/products/it-process-portal-management/sbm/overview/
>> # Version: Tested and working on 10.01.04.01.1068 (build 10)
>> Serena Business Manager is vulnerable to a DOM cross-site scripting (XSS)
>> attack. The attack allows execution of arbitrary JavaScript in the context
>> of the user’s browser.
>> Vulnerability resides in source location.href at tmtrack.dll and sink
>> jQuery.html
>>
>> Example:
>> The SBM User Workspace cannot be embedded in another frame.<br><a
>> href=http://link/tmtrack/tmtrack.dll target=_new>1337</a>
>>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/