User are receiving mobile notifications of restricted Jira comments that they cannot view when accessing Jira through a browser

Hi Jira Server mobile app beta users, We recently discovered a bug where Jira Server mobile app users receive all comment notifications from Jira issues they’re watching or assigned to, even if the comment had been restricted to exclude them. This means they’ll be able to view the content of...

xss vulnerability in frontend comment manager of fishleap CMS

Fish CMS is a content management system developed by the official Catfish CMS specifically for enterprise applications. An XSS vulnerability exists in the front-end comment management system of FishCenter CMS, which can be exploited by an attacker to obtain an administrator cookie...

CVE-2018-18845

internal/advancedcommentsystem/index.php and internal/advancedcommentsystem/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACSpath. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTM...

CVE-2018-18845

internal/advancedcommentsystem/index.php and internal/advancedcommentsystem/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACSpath. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTM...

Cross site scripting

internal/advancedcommentsystem/index.php and internal/advancedcommentsystem/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACSpath. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTM...

ghostscript security and bug fix update

9.07-31.el76.10 - Resolves: 1673915 - ghostscript: Regression: double comment chars '%' in gsinit.ps leading to missing metadata - Resolves: 1678171 - CVE-2019-3835 ghostscript: superexec operator is available 700585 - Resolves: 1680025 - CVE-2019-3838 ghostscript: forceput in DefineResource is...

CVE-2018-18845

Summary of CVE-2018-18845 (Advanced Comment System): The affected product is Advanced Comment System, version 1.0. The vulnerability is a reflected cross-site scripting (XSS) flaw in internal/advanced_comment_system/index.php and internal/advanced_comment_system/admin.php via ACS_path. A remote, ...

WordPress 5.1: from CSRF to RCE-vulnerability warning-the black bar safety net

One, Foreword Note: this exploit and the environment is more complex, the actual value may not be very high, but forXSSwith permissions management also has certain reference value. Last month we published a WordPress 5.0, a remote code execution RCE）vulnerabilities required by the authentication...

CVE-2018-18845: Improper Neutralization of Input During Web Page Generation

internal/advancedcommentsystem/index.php and internal/advancedcommentsystem/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACSpath. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTM...

Cross-Site Request Forgery (CSRF)

wordpress is vulnerable to cross-site request forgery CSRF. The vulnerability exists as it does not have any CSRF protections in place to prevent forged request when posting comments. Moreover, a lack of comment content filtering when an administrative user posts a comment, allows a remote attack...

DEBIAN-CVE-2019-9787

WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...

Design/Logic Flaw

WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...

New WordPress Flaw Lets Unauthenticated Remote Attackers Hack Sites

If for some reason your WordPress-based website has not yet been automatically updated to the latest version 5.1.1, it's highly recommended to immediately upgrade it before hackers could take advantage of a newly disclosed vulnerability to hack your website. Simon Scannell, a researcher at RIPS...

CVE-2019-9765

In Blogmini 1.0, XSS exists via the author name of a comment reply in the app/main/views.py articleDetails function, related to app/templates/articlecomments.html...

CVE-2019-9765

In Blogmini 1.0, XSS exists via the author name of a comment reply in the app/main/views.py articleDetails function, related to app/templates/articlecomments.html...

Cross site scripting

In Blogmini 1.0, XSS exists via the author name of a comment reply in the app/main/views.py articleDetails function, related to app/templates/articlecomments.html...

CVE-2019-9765

In Blogmini 1.0, XSS exists via the author name of a comment reply in the app/main/views.py articleDetails function, related to app/templates/articlecomments.html...

WordPress 3.9-5.1 - Comment Cross-Site Scripting (XSS)

Description According to WordPress: "This release also includes a pair of security fixes that handle how comments are filtered and then stored in the database. With a maliciously crafted comment, a WordPress post was vulnerable to cross-site scripting."...

Advanced Comment System 1.0 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications 0day.today 2019-03-09...

GNU Libextractor ZIP File Comment Out-of-Bounds Read (CVE-2018-16430)

An out-of-bounds read vulnerability exists in Libextractor. The vulnerability is due to improper handling of long File Comment fields within ZIP files. Successful exploitation of this vulnerability could lead to denial-of-service conditions or disclosure of sensitive information...