4564 matches found
PT-2019-19914
Name of the Vulnerable Software and Affected Versions: WPGraphQL version 0.2.3 Description: The issue allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled, through the createComment mutation. Recommendations: For WPGraphQL version 0.2.3, consider...
PT-2019-11643 · Fat Free Crm · Fat Free Crm
Name of the Vulnerable Software and Affected Versions: Fat Free CRM version 0.19.0 Description: A HTML Injection issue has been reported in the Fat Free CRM product, specifically via an authenticated request to the "/comments" URI. The vendor disputes the significance of this report, citing that...
CVE-2019-10226: Improper Neutralization of Input During Web Page Generation
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting such as with an H1 element is allowed, but there is a XSS protection...
WordPress WPGraphQL 0.2.3 Authentication Bypass / Information Disclosure
!/usr/bin/env python Author: Simone Quatrini of Pen Test Partners CVEs: 2019-9879, 2019-9880, 2019-9881 Tested on Wordpress 5.1.1 and wp-graphql 0.2.3 https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/ import argparse import requests import base64 import json import sys parse...
CVE-2019-5883
An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 6.0 and later but before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. The issue comments feature could allow a user to comment on an issue which they shouldn't be allowed to...
CVE-2019-5883
An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 6.0 and later but before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. The issue comments feature could allow a user to comment on an issue which they shouldn't be allowed to...
CVE-2019-5883
Removed by vendor...
PT-2019-17841
Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 6.0 through 11.3.10 GitLab Community and Enterprise Edition versions 11.4.0 through 11.4.7 GitLab Community and Enterprise Edition versions 11.5.0 through 11.5.0 Description An issue was...
CVE-2019-5883: Undefined Security Weakness
An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 6.0 and later but before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. The issue comments feature could allow a user to comment on an issue which they shouldn't be allowed to...
CVE-2019-11206
The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow a malicious user to undermine the integrity of comments and bookmarks. Affected releases are TIBCO Software...
Input validation
The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow a malicious user to undermine the integrity of comments and bookmarks. Affected releases are TIBCO Software...
CVE-2019-11206 TIBCO Spotfire Server Vulnerabilities With Integrity of Comments and Bookmarks
The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow a malicious user to undermine the integrity of comments and bookmarks. Affected releases are TIBCO Software...
CVE-2019-11206
The CVE-2019-11206 entry affects TIBCO Spotfire products: Spotfire Analytics Platform for AWS Marketplace and Spotfire Server, where the Spotfire library component is vulnerable. The issue could allow a malicious user to undermine the integrity of comments and bookmarks. Affected releases include...
XSS Vulnerability at JEESNS Group Comments
JEESNS is an open source social management system developed on JAVA's enterprise-class platform. JEESNS group comments at the existence of XSS vulnerability , an attacker can be exploited to inject arbitrary Web script or HTML...
XSS Vulnerability in JEESNS Article Comments
JEESNS is an open source social management system developed on JAVA's enterprise-class platform. JEESNS article comments at the XSS vulnerability , an attacker can use the vulnerability to inject arbitrary Web script or HTML...
PT-2019-12184 · Tibco · Tibco Spotfire Server +1
Name of the Vulnerable Software and Affected Versions: TIBCO Spotfire Analytics Platform for AWS Marketplace versions up to and including 10.2.0 TIBCO Spotfire Server versions up to and including 10.2.0 Description: The Spotfire library component contains vulnerabilities that theoretically allow ...
CVE-2019-11206: Undefined Security Weakness
The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow a malicious user to undermine the integrity of comments and bookmarks. Affected releases are TIBCO Software...
CVE-2019-11835
cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments...