Httpdbg
Monthly
Stored cross-site scripting (XSS) in httpdbg before 2.2.1 allows an attacker who controls or influences a URL captured by the tool to inject a javascript: scheme link that executes script in the application origin when a user clicks it (CVSS:4.0 5.3, UI:P, PR:N, so unauthenticated but requiring user interaction). Successful exploitation exposes the recorded request and response data httpdbg displays - including headers and captured tokens - because the malicious script runs in the origin of the local debugging web interface. The issue is not reported as actively exploited and no public exploit code has been identified at time of analysis, and the practical exposure is narrowed by httpdbg's use as a developer-facing, typically local debugging tool that a victim must open and interact with; vendor-released patch: 2.2.1.
Stored cross-site scripting (XSS) in httpdbg before 2.2.1 allows an attacker who controls or influences a URL captured by the tool to inject a javascript: scheme link that executes script in the application origin when a user clicks it (CVSS:4.0 5.3, UI:P, PR:N, so unauthenticated but requiring user interaction). Successful exploitation exposes the recorded request and response data httpdbg displays - including headers and captured tokens - because the malicious script runs in the origin of the local debugging web interface. The issue is not reported as actively exploited and no public exploit code has been identified at time of analysis, and the practical exposure is narrowed by httpdbg's use as a developer-facing, typically local debugging tool that a victim must open and interact with; vendor-released patch: 2.2.1.