CVE-2020-13868

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity...

CVE-2020-13869

The CVE-2020-13869 issue affects the Craft CMS Comments plugin prior to version 1.5.6. It enables stored XSS via the guest name field, due to insufficient input sanitization (as corroborated by multiple sources). Impact: attacker-supplied guest name can inject scripts and run in a user’s browser....

CVE-2020-13869

An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name...

CVE-2020-13869

An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name...

CVE-2020-13870

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name...

CVE-2020-13870

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name...

CVE-2020-13870

CVE-2020-13870 affects the Craft CMS Comments plugin prior to 1.5.5, with a stored XSS flaw via an asset volume name. Root cause: lack of input validation leading to stored XSS. Impact is dependent on affected Craft CMS deployments; remediation is to upgrade the Comments plugin to 1.5.5 or later....

CVE-2020-13870: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name...

PT-2020-13743

Name of the Vulnerable Software and Affected Versions Craft CMS Comments plugin versions prior to 1.5.5 Description A stored XSS issue was discovered via an asset volume name. Recommendations For versions prior to 1.5.5, update to version 1.5.5 or later to resolve the issue...

PT-2020-13741

Name of the Vulnerable Software and Affected Versions Craft CMS Comments plugin versions prior to 1.5.5 Description An issue affects comment integrity due to CSRF. Recommendations For versions prior to 1.5.5, update to version 1.5.5 or later to resolve the issue...

CVE-2020-13869: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name...

CVE-2020-13868: Cross-Site Request Forgery (CSRF)

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity...

PT-2020-13742

Name of the Vulnerable Software and Affected Versions Comments plugin for Craft CMS versions prior to 1.5.6 Description The issue is related to stored XSS via a guest name. This allows for malicious code to be stored and executed when a user interacts with the affected component. Recommendations...

hibernate-validator: safeHTML validator allows XSS

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack...

hibernate-validator: safeHTML validator allows XSS

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack...

Cross-Site Scripting (XSS)

ssddanbrown/bookstack is vulnerable to cross-site scripting XSS. Lack of validation and sanitization allows a remote attacker to inject and execute arbitrary Javascript in a user's browser via the comments...

Cross-Site Scripting in BookStack

Impact A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machine...

GHSA-5VF7-Q87H-PG6W Cross-Site Scripting in BookStack

Impact A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machine...

The vulnerability of the WordPress website content management system, related to the lack of measures taken to protect the structure of web pages, allows attackers to compromise the integrity of data.

The vulnerability of the WordPress content management system is related to an error in the reproduction of XSS attacks in comments. Exploiting this vulnerability could allow a malicious actor to compromise data integrity...

UBUNTU-CVE-2020-11036

In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content "alert1" reproduces the attack. This can be exploited by a user with administrator privileges i...