Re: Weird 'script' in Username column in audit log file

Yep - someone or some script is testing Cross-site Scripting (XSS) 
vulnerabilities...


> Hello,
> 
> Has anyone ever seen this sort of thing before?
> 
> 2019-11-28 13:57:24  Login.Failure   178.165.72.177            
> </script>"><script>prompt(1)</script>
> 
> 2019-11-28 13:57:39  Login.Failure   23.129.64.190 <script>alert(1)</script>
> 
> 2019-11-28 13:57:48  Login.Failure   109.70.100.28 
> "><script>alert(1)</script>
> 
> 2019-11-28 13:58:07  Login.Failure   185.220.101.70           
> '><script>alert(1)</script>
> 
> When I was pasting my log contents into the audit check spreadsheet we 
> use this morning, this particular file’s contents wouldn’t paste full – 
> it would stop at these entries and didn’t include the last row of data 
> either, as if the script stuff had prevented the rest from pasting in.
> 
> Does anyone know what this means? I’ve never seen it before in our logs.
> 
> 
> Thanks,
> 
> *Patricia Farnan** |***Application Administrator, Discovery Services
> 
> University Library*** |***St Teresa’s Library**
> 
> //
> 
> *The University of Notre Dame Australia*
> 19 Mouat Street (PO Box 1225)
> Fremantle WA 6959
> Telephone: +61 8 *9433 0707 **| *Email: [email protected] 
> <mailto:[email protected]>
> 
> *nd.edu.au|***CRICOS Provider:  01032F
> 
> **
> 
> *Library* <http://library.nd.edu.au/>*| **AskUs* 
> <http://askus.library.nd.edu.au/>**
> 
> I respect and acknowledge the Nyungar Elders and the Wadjuk Nyungar 
> people as the Traditional Owners and Custodians of this country on which 
> I work.//
> 
> 
> 
> *Disclaimer*
> 
> IMPORTANT: This e-mail and any attachments may be confidential. If you 
> are not the intended recipient you should not disclose, copy, 
> disseminate or otherwise use the information contained in it. If you 
> have received this e-mail in error, please notify us immediately by 
> return e-mail and delete or destroy the document. Confidential and legal 
> privilege are not waived or lost by reason of mistaken delivery to you. 
> The University of Notre Dame Australia is not responsible for any 
> changes made to a document other than those made by the University. 
> Before opening or using attachments please check them for viruses and 
> defects. Our liability is limited to re-supplying any affected attachments.
> 
> 
> ------------------------------------------------------------------------
> 
> To unsubscribe from the EZPROXY-L list, click the following link:
> http://listserv.oclclists.org/scripts/wa.exe?SUBED1=EZPROXY-L&A=1
> 

-- 

Dr. Andreas Bohne-Lang, Diplom-Informatiker
EDV / Bibliothek
Medizinische Fakultät Mannheim
Universität Heidelberg
Ludolf-Krehl-Str. 13-17
68167 Mannheim
Tel:   ++49(0)621-383-71990  Fax: -71981
eMail: [email protected]

********************************************************************
If you wish to stop receiving messages from EZPROXY-L or otherwise amend your preferences,
you can do so <a href="https://www.oclc.org/forms/internet-subscription.en.html">here</a>.
Or email [email protected] including the relevant text below in the body of the email:
• To unsubscribe: "unsubscribe EZPROXY-L"
• To receive EZPROXY-L in digest form: "set EZPROXY-L digest"
• To set your options to no mail: "set EZPROXY-L nomail"
• To receive these messages in the future "set EZPROXY-L mail"
To contact the list owners directly please send your message to [email protected].
If you unsubscribe from EZPROXY-L, you will no longer be able to participate in any of its features, including the public forum.
To unsubscribe from all OCLC marketing email communications
(including all OCLC listervs, OCLC Connect emails, OCLC event notifications, product/service/cooperative updates and newsletters),
please email us at [email protected].