Showing posts from 2012

HTML Injection in

Title : HTML Injection in Vuln URL : Author : Yogesh D Jaygadkar Reported : July 02, 2012 Fixed : July 03, 2013 Public Released :  July 03, 2013 OS : Win7, Win XP, Ubuntu Description: HTML injection is a type of attack focused upon the way HTML content is generated and interpreted by browsers at client side. so if an attacker embeds html/script tags such <html>, <SCRIPT> , <OBJECT> , <APPLET> , or <EMBED> into a web site, the web browser's JavaScript engine will execute it. While searching about some anti-virus related information i found that  Symantec Antivirus  official website is vulnerable to HTML Injection. Attacker can add  HTML Tags  into URL to execute html code on website. Screenshot 1 : Screenshot 2 :

Listed in Microsoft's Security Researcher Page

finally I'm listed in  Security Researcher Acknowledgments for Microsoft Online Services Thanks to Microsoft & specially Nate from Microsoft for quick response.Thanks to all my friends. Vulnerable to XSS - Cross Site Scripting

Title: Vulnerable to XSS - Cross Site Scripting Script Link: &>">/* Script Here */=1 &SZ=0&symbol=Asp& Author: Yogesh Jaygadkar  Reported: Tuesday, May 01, 2012  Vulnerability Fix date : 22 May 2012  Public Release: 22 May 2012  Browser : FireFox , IE OS : Win7 , Ubuntu Description:  XSS - Cross Site Scripting Vulnerability found in .Cross-Site Scripting attacks are a type of injection problem, in which malicious scripts are injected into the trusted web sites. Cross-site scripting (XSS) attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere. An attacker can use XSS to send a malicious script to an u