4861 matches found
ERPnext 11 - Cross-Site Scripting
ERPnext 11 - Cross-Site Scripting Exploit Title: ERPnext 11.x.x - Cross-Site Scripting Date: 2018-05-10 Exploit Author: Veerababu Penugonda Vendor Homepage: https://erpnext.com/ Software Link: https://demo.erpnext.com/ Version: Frappe ERPNext v11.x.x-develop Tested on: Mozilla Firefox quantum 60....
SAP Internet Graphics Server HTTP and RFC listener denial of service vulnerability
SAP Internet Graphics Server IGS is a graphics server from SAP, Germany. The product is able to generate graphs or charts in different areas.HTTP is one of the hypertext transfer protocols; RFC listener is one of the RFC listener. A security vulnerability exists in HTTP and RFC listener in SAP IG...
CVE-2018-11339: Improper Neutralization of Input During Web Page Generation
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment...
ERPnext 11 - Cross-Site Scripting
Exploit Title: ERPnext 11.x.x - Cross-Site Scripting Date: 2018-05-10 Exploit Author: Veerababu Penugonda Vendor Homepage: https://erpnext.com/ Software Link: https://demo.erpnext.com/ Version: Frappe ERPNext v11.x.x-develop Tested on: Mozilla Firefox quantum 60.1 , Ubuntu OS CVE : CVE-2018-11339...
ruibaby Halo Cross-Site Scripting Vulnerability
ruibaby Halo is a Java-based blogging system. A cross-site scripting vulnerability exists in ruibaby Halo version 0.0.2. A remote attacker can inject arbitrary web script or HTML by sending the commentAuthor field to the FrontCommentController.java file...
Cross site scripting
Cross-site scripting XSS vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in a comment on an Instagram post...
CVE-2018-10301: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in a comment on an Instagram post...
Cross site scripting
Catfish CMS V4.7.21 allows XSS via the pinglun parameter to cat/index/index/pinglun aka an authenticated comment...
CVE-2014-1398
The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions on comment, user and node statistics properties via unspecified vectors...
CVE-2014-1398: Improper Access Control
The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions on comment, user and node statistics properties via unspecified vectors...
VK.com: Reflected XSS в /al_audio.php
XSS в аудио. XSS в прикреплении аудиозаписи в виджете комментариев...
coinimaging.com XSS vulnerability
Open Bug Bounty ID: OBB-598563 Description| Value ---|--- Affected Website:| coinimaging.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Drupal 8 – CVE-2017-6926漏洞详解
作者：绿盟科技 来源： 近期，著名的Drupal CMS网站爆出7个漏洞，其中1个严重漏洞CVE-2017-6926，具有发表评论权限的用户可以查看他们无权访问的内容和评论，并且还可以为该内容添加评论。绿盟科技于上周发布了《Drupal下周将发布重要安全补丁威胁预警通告》。 本篇文章对Drupal 8 – CVE-2017-6926漏洞进行了详细分析。 CVE-2017-6926 漏洞详情 先看下drupal官网的通告： 有发布评论权限的用户，可以查看他们无权访问的内容和评论。 并且还可以为此内容添加评论。 想要触发这个漏洞，必须启用评论系统，并且攻击者必须有权发布评论。...
CVE-2018-9121
In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post comment...
Cross site scripting
In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post comment...
CVE-2018-9121
In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post comment...
CVE-2018-9121
CVE-2018-9121 affects Crea8social 2018.2 with a Stored Cross‑Site Scripting (XSS) vulnerability in post comments. The NVD notes CVSS2/3 base scores of 3.5 (LOW) and 5.4 (MEDIUM) respectively, indicating a potential impact on integrity/ confidentiality as described. Connected sources reiterate sto...
CVE-2018-9121: Improper Neutralization of Input During Web Page Generation
In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post comment...
Memory corruption
xvpng.c in xv 3.10a has memory corruption out-of-bounds write when decoding PNG comment fields, leading to crashes or potentially code execution, because it uses an incorrect length value...