>> # Exploit Title: Serena Business Manager < 10.01 DOM XSS Vulnerability >> # Date: 11-feb-16 >> # Exploit Author: Zeroday.pro Labs >> # Software Link: >> https://www.serena.com/index.php/en/products/it-process-portal-management/sbm/overview/ >> # Version: Tested and working on 10.01.04.01.1068 (build 10) >> Serena Business Manager is vulnerable to a DOM cross-site scripting (XSS) >> attack. The attack allows execution of arbitrary JavaScript in the context >> of the user’s browser. >> Vulnerability resides in source location.href at tmtrack.dll and sink >> jQuery.html >> >> Example: >> The SBM User Workspace cannot be embedded in another frame.<br><a >> href=http://link/tmtrack/tmtrack.dll target=_new>1337</a> >>
_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
