CVE-2025-22828

CloudStack users can add and read comments annotations on resources they are authorised to access. Due to an access validation issue that affects Apache CloudStack versions from 4.16.0, users who have access, prior access or knowledge of resource UUIDs can list and add comments annotations to suc...

UBUNTU-CVE-2023-5117

An issue was discovered in GitLab CE/EE affecting all versions before 17.6.0 in which users were unaware that files uploaded to comments on confidential issues and epics of public projects could be accessed without authentication via a direct link to the uploaded file URL...

CVE-2024-54406

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in moallemi Comments On Feed comments-on-feed allows Reflected XSS.This issue affects Comments On Feed: from n/a through = 1.2.1...

CVE-2024-54406 WordPress Comments On Feed plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in moallemi Comments On Feed comments-on-feed allows Reflected XSS.This issue affects Comments On Feed: from n/a through = 1.2.1...

CVE-2024-54406 WordPress Comments On Feed plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Reza Moallemi Comments On Feed allows Reflected XSS.This issue affects Comments On Feed: from n/a through 1.2.1...

CVE-2024-54406: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in moallemi Comments On Feed comments-on-feed allows Reflected XSS.This issue affects Comments On Feed: from n/a through = 1.2.1...

GitLab Enterprise Edition（EE）和GitLab Community Edition（CE） 安全漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A security vulnerability exists in GitLab Enterprise Edition EE and GitLab Community...

WordPress plugin 畅言评论系统 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security...

PT-2024-17663 · WordPress · Minify Html

Name of the Vulnerable Software and Affected Versions: Minify HTML plugin for WordPress versions up to, and including, 2.1.10 Description: The issue is related to a Regular Expression Denial of Service ReDoS vulnerability. This vulnerability arises from the plugin's processing of user-supplied...

WordPress Comments On Feed plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Comments On Feed versions = 1.2.1...

python: Improper validation of IPv6 and IPvFuture addresses

A flaw was found in Python. The urllib.parse.urlsplit and urlparse functions improperly validated bracketed hosts , allowing hosts that weren't IPv6 or IPvFuture compliant. This behavior was not conformant to RFC 3986 and was potentially vulnerable to server-side request forgery SSRF if a URL is...

CVE-2023-23886

Missing Authorization vulnerability in mg12 WP-RecentComments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-RecentComments: from n/a through 2.2.7...

PT-2024-12007 · WordPress · Wp-Recentcomments

Name of the Vulnerable Software and Affected Versions: WP-RecentComments versions through 2.2.7 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For WP-RecentComments version...

USN-7137-1 recutils vulnerabilities

It was discovered that recutils incorrectly handled memory when parsing comments with the recparser utility. An attacker could possibly use this issue to cause a denial of service or run arbitrary commands. CVE-2021-46019, CVE-2021-46021, CVE-2021-46022 It was discovered that recutils incorrectly...

CVE-2024-11479

CVE-2024-11479 concerns Issuetrak 17.1. An authenticated user can inject HTML into ticket comments, which is then rendered in emails sent to all users on that ticket. The affected component is the comment handling in tickets; the root cause is HTML injection in comments. Publicly stated impact is...

Issuetrak 安全漏洞

Issuetrak is an issue tracking software from Issuetrak, Inc. A security vulnerability exists in Issuetrak version 17.1, which stems from the presence of an HTML injection vulnerability that allows an authenticated attacker to add HTML markup to the comments of a work order that, when submitted,...

CVE-2024-11479: Improper Neutralization of Input During Web Page Generation

A HTML Injection vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. HTML markup could be added to comments of tickets, which when submitted will render in the emails sent to all users on that ticket...

PT-2024-17019

Name of the Vulnerable Software and Affected Versions Issuetrak version 17.1 Description A HTML Injection issue was identified that could be triggered by an authenticated user. HTML markup could be added to comments of tickets, which when submitted will render in the emails sent to all users on...

The vulnerability of the “Delegate my view right” function in the PDF viewer macro of the XWiki PDF Viewer Macro (Pro) allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the “Delegate my view right” function in the PDF viewer macro of XWiki PDF Viewer Macro Pro relates to the display of confidential information in the source code comments. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access t...

CVE-2024-52595

lxmlhtmlclean is a project for HTML cleaning functionalities copied from "lxml.html.clean". Prior to version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags such as "", "" and "". This behavior deviates from how web browsers parse and interpret such...