Restrictions not applied for inline comments in attachments

When there is a comment for a file which is attached to a restricted page, all users can see the comment, even the ones who are not allowed to see the page and its attachments. h3. Workaround for 5.7 There is no workaround for customers running Confluence 5.7. Customers are advised to upgrade to...

Enano CMS 1.1.8pl1 Cross Site Scripting

Exploit Title: EnanoCMS 1.1.8pl1 XSS Vulnerability Google Dork: "Website engine powered by Enano" Date: 24-2-2015 Exploit Author: Dennis Veninga Vendor Homepage: http://enanocms.org Version: 1.1.8pl1 Tested on: Firefox 36 & Chrome 38 / W8.1-x64 XSS Vulnerability in comments:...

Bugzilla < 4.0.15 / 4.2.11 / 4.4.6 / 4.5.6 Multiple Vulnerabilities

Binary data 8606.prm...

[SECURITY] Fedora 20 Update: drupal6-flag-2.1-3.fc20

Flag is a flexible flagging system that is completely customizable by the administrator. Using this module, the site administrator can provide any number of flags for nodes, comments, users, and any other type of entity. Some possibilities include bookmarks, marking important, friends, or flag as...

Sql injection

Multiple SQL injection vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to execute arbitrary SQL commands via the 1 iDisplayLength or 2 iDisplayStart parameter to a commentspaginate.php or b storespaginate.php in admin/ajax/...

PT-2015-3678

Name of the Vulnerable Software and Affected Versions couponPHP versions prior to 1.2.0 Description The issue concerns SQL injection vulnerabilities in the admin area. These vulnerabilities allow remote administrators to execute arbitrary SQL commands. The vulnerabilities are specifically related...

comments.club.cnews.ru XSS vulnerability

Open Bug Bounty ID: OBB-53116 Description| Value ---|--- Affected Website:| comments.club.cnews.ru Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

CVE-2014-8724

Cross-site scripting XSS vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the "Cache key" in the HTML-Comments, as demonstrated by the PATHINFO to the default URI...

Cross site scripting

Cross-site scripting XSS vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the "Cache key" in the HTML-Comments, as demonstrated by the PATHINFO to the default URI...

PT-2014-8691 · Frederick Townes · W3 Total Cache

Name of the Vulnerable Software and Affected Versions: W3 Total Cache plugin versions prior to 0.9.4.1 Description: The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the Cache key in the HTML-Comments when debug...

W3 Total Cache <= 0.9.4 - Debug Mode XSS

If debug mode is enabled an XSS vector exists in the HTML comments...

Security advisory for Bugzilla 4.5.6, 4.4.6, 4.2.11, and 4.0.15

Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: The 'realname' parameter is not correctly filtered on user account creation, which could lead to user data override. Several...

MGASA-2014-0412 Updated bugzilla packages fix security vulnerabilities

Updated bugzilla packages fix security vulnerabilities: If a new comment was marked private to the insider group, and a flag was set in the same transaction, the comment would be visible to flag recipients even if they were not in the insider group CVE-2014-1571. An attacker creating a new Bugzil...

Updated bugzilla packages fix security vulnerabilities

Updated bugzilla packages fix security vulnerabilities: If a new comment was marked private to the insider group, and a flag was set in the same transaction, the comment would be visible to flag recipients even if they were not in the insider group CVE-2014-1571. An attacker creating a new Bugzil...

Arachni Web Application Scanner Web UI - Stored XSS Vulnerability

No description provided by source. Title: Arachni Web Application Scanner Web UI Stored XSS Vulnerability CVE: 2014-5469 Vendor Homepage: http://www.arachni-scanner.com/ Author: Prakhar Prasad Author Homepage: https://prakharprasad.com Reference: https://github.com/Arachni/arachni-ui-web/issues/7...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 activate or 2 deactivate the plugin via the active parameter to wp-admin/edit-comments.php, 3...

NOSpamPTI 2.1 - wp-comments-post.php comment_post_ID Parameter SQL Injection

The nospampti WordPress plugin was affected by a wp-comments-post.php commentpostID Parameter SQL Injection security vulnerability...

Featured Comments 1.2.1 - wp-admin/admin-ajax.php Comment Status Manipulation CSRF

The Featured Comments WordPress plugin was affected by a wp-admin/admin-ajax.php Comment Status Manipulation CSRF security vulnerability...

Subscribe To Comments Reloaded 140204 - options/index.php manager_page Parameter Stored XSS Weakness

The Subscribe To Comments Reloaded WordPress plugin was affected by an options/index.php managerpage Parameter Stored XSS Weakness security vulnerability...

WordPress Subscribe To Comments Reloaded Plugin <= 140204 - CSRF

This plugin is prone to an options/index.php admin settings manipulation CSRF vulnerability. It allows to perform unauthorized actions in the context of a logged-in user of the affected application. Solution Update the plugin...