Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger Research describes HTML5 storage manipulation as a stored DOM-based issue where a script writes attacker-controllable data into the browser's localStorage or sessionStorage, letting an attacker construct a URL that causes another user's browser...
PortSwigger describes reflected DOM-based HTML5 storage manipulation as a script storing attacker-controllable data in the browser's localStorage or sessionStorage, letting an attacker build a URL that makes another user's browser store that data. The...
PortSwigger describes HTML5 storage manipulation as a DOM-based issue where a client-side script stores controllable data, such as data from the URL, in the browser's localStorage or sessionStorage. The storage itself is not a vulnerability, but if the...
Stored DOM-based HTML5 web message manipulation occurs when user input is stored and later embedded into a response in a part of the DOM that a client-side script processes unsafely, and a script then sends that controllable data as a web message to...
PortSwigger describes reflected DOM-based HTML5 web message manipulation as a flaw where data copied from a request is echoed into the immediate response in a part of the DOM processed unsafely by a client-side script, and a script sends controllable data...
PortSwigger describes DOM-based HTML5 web message manipulation as a flaw where a client-side script sends controllable data, such as data from the URL, as a web message to another document in the browser. An attacker can construct a URL that, when visited...
Stored DOM-based denial of service occurs when user input is stored and later embedded into a response within a part of the DOM that a client-side script processes unsafely, passing controllable data to a problematic platform API. An attacker can construct...
Reflected DOM-based vulnerabilities occur when data from a request is echoed into the immediate response inside a part of the DOM that a client-side script then processes unsafely, letting an attacker control a piece of the response such as a JavaScript...
DOM-based denial of service occurs when a client-side script passes controllable data, such as data from the URL, to a problematic platform API in an unsafe way. An attacker can construct a URL that, when visited by another user, causes that user's...
PortSwigger describes stored DOM-based Ajax request header manipulation, which occurs when user input is stored and later embedded into the DOM, where a client-side script writes that controllable data into a header of an XmlHttpRequest. An attacker may...
Reflected DOM-based vulnerabilities occur when data from a request is echoed into the immediate response inside a part of the DOM that a client-side script then processes unsafely. Ajax request header manipulation is a specific case where a script writes...
PortSwigger describes DOM-based Ajax request header manipulation as a flaw where a client-side script writes controllable data, such as URL input, into a header of an XmlHttpRequest. An attacker can then build a URL that, when visited by another user, sets...
PortSwigger describes DOM-based cookie manipulation as a stored DOM-based vulnerability where a script writes controllable data into a cookie's value, letting an attacker construct a URL that sets an arbitrary value in another user's cookie when visited....
Reflected DOM-based vulnerabilities occur when data from a request is echoed into the immediate response inside a part of the DOM that a client-side script then processes unsafely, and DOM-based cookie manipulation occurs when a script writes controllable...
DOM-based cookie manipulation occurs when a client-side script writes controllable data, such as data from the URL, into a cookie's value, letting an attacker construct a URL that sets an arbitrary value in another user's cookie. The impact depends on the...
The HTTP TRACE method, designed for diagnostic purposes, causes a web server to echo the exact request it received back in its response. PortSwigger notes this is often harmless but can disclose sensitive information such as internal authentication headers...
PortSwigger Research describes applications that set the response header X-XSS-Protection: 0, which tells browsers with built-in cross-site scripting filters, including Internet Explorer, to turn those filters off. The text notes this is not a...
PortSwigger Research describes clickjacking as an attack that becomes possible when a page fails to set an X-Frame-Options or Content-Security-Policy HTTP header, letting an attacker-controlled page load it in an iframe and overlay it with a different...
PortSwigger Research notes that file upload functionality is commonly associated with a number of vulnerabilities and is not straightforward to implement securely. It advises reviewing upload features to understand their purpose and whether uploaded...
PortSwigger Research describes applications that issue a cookie containing the clear-text value of the password a user supplied. The write-up notes that any cookie-stealing vulnerability in the application or browser would then let an attacker take the...
PortSwigger Research describes a password field with autocomplete enabled, where browsers that remember entered credentials store them locally and retrieve them on future visits to the same application. The stored credentials can be captured by an attacker...
PortSwigger Research describes the risk of placing session tokens in URLs, noting that sensitive information in URLs may be logged in the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also...
PortSwigger Research describes the HttpOnly cookie attribute as a setting that prevents client-side JavaScript from reading or setting a cookie's value, which makes cross-site scripting attacks slightly harder to exploit by blocking trivial capture of the...
PortSwigger Research describes the cross-domain script include issue: when an application loads a script from an external domain, the browser runs it in the invoking application's security context, so it can access application data and act as the current...
PortSwigger describes how browsers attach a Referer header to cross-domain requests, so any sensitive data in the originating URL's query string, such as a session token, is sent to the other domain. The write-up notes browsers may withhold the header in...
A cookie's domain attribute determines which domains can access it, and a cookie scoped to a parent domain is accessible by that parent and all of its subdomains. If the cookie holds sensitive data such as a session token, less trusted or less secure...
PortSwigger Research describes a cookie that carries the TLS name but lacks the secure flag, so browsers will send it in clear text over any unencrypted HTTP request within the cookie's scope. An attacker positioned to eavesdrop on the victim's traffic can...
PortSwigger describes stored DOM-based open redirection, which occurs when user input is stored and later written into a redirection target by a client-side script in an unsafe way. An attacker can then build a URL that, when visited by another user,...
PortSwigger describes reflected DOM-based open redirection, which occurs when data from a request is echoed into the immediate response in a part of the DOM that a client-side script then processes unsafely, and a script writes controllable data into a...
DOM-based open redirection occurs when a client-side script writes controllable data, such as data from the URL, into a redirection target in an unsafe way, letting an attacker construct a URL that redirects another user to an arbitrary external domain....