4855 matches found
Mozilla Wants to Drop WoSign as Trusted CA
Mozilla has accused a Chinese Certificate Authority of back-dating SHA-1 certificates to get around restrictions barring deprecated certs from being trusted, and is ready to ban the CA for one year. The back-dating is just one of many violations derived after a lengthy investigation of WoSign and...
Pornhub: Stored XSS in photo comment functionality
The photo comment functionality is vulnerable to stored cross site scripting: an attacker can craft a comment that contains malicious code and get it stored. This can be reproduced on my test account at http://www.pornhub.com/photo/166952961. Interestingly, differently from 171901 where i could...
Users without "Administer comments" can set comment visibility on nodes they can edit
More info at https://www.drupal.org/SA-CORE-2016-004...
Users without "Administer comments" can set comment visibility on nodes they can edit
More info at https://www.drupal.org/SA-CORE-2016-004...
Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2016-004
Users without "Administer comments" can set comment visibility on nodes they can edit. Less critical Users who have rights to edit a node, can set the visibility on comments for that node. This should be restricted to those who have the administer comments permission. Cross-site Scripting in http...
Nextcloud: Reflected Self-XSS Vulnerability in the Comment section of Files (Different-payloads)
Note::steps mentioned in report164027 In the Comments Box,the payload to execute XSS is passed. Test Payloads: alert1 Also the above payload is still working.. Also try this payload " fooalert1 Click edit comment after posted. XSS Triggers...
Nextcloud: Reflected Self-XSS Vulnerability in the Comment section of Files Information
Vulnerability Found In the test domain: demo.nextcloud.com Vulnerability Type : Reflected XSS STEPS TO REPRODUCE: STEP 1: Login to demo nextcloud server site using test credentials.demo.nextcloud.com STEP 2: On the All Files Tab ,Select Any File. STEP 3: A tab opens on the Right Hand side of the...
CVE-2015-5399
Cross-site scripting XSS vulnerability in PHPVibe before 4.21 allows remote authenticated users to inject arbitrary web script or HTML via a comment...
Cross site scripting
Cross-site scripting XSS vulnerability in PHPVibe before 4.21 allows remote authenticated users to inject arbitrary web script or HTML via a comment...
CVE-2015-5399
Cross-site scripting XSS vulnerability in PHPVibe before 4.21 allows remote authenticated users to inject arbitrary web script or HTML via a comment...
OLX: full path disclosure vulnerability at https://security.olx.com/*
in form of html comment it disclosing full path of file name Security.html in all https://security.olx.com/ links...
Dahan jcms /jcms/jcms_files/jcms1/web1/site/module/comment/opr_ballot. jsp parameters c_uuid time blind
No description provided by source...
JSON export doesn't differentiate public from internal comments
h4. +Summary+ Currently, when exporting a SD request to JSON format, it's not possible to tell which comment is internal or public from the JSON file. h4. +Steps to reproduce+ Go to Manage add-ons - All add-ons - jira-importers-plugin - Enable JSON export Create an SD request and add one internal...
JSON export doesn't differentiate public from internal comments
h4. +Summary+ Currently, when exporting a SD request to JSON format, it's not possible to tell which comment is internal or public from the JSON file. h4. +Steps to reproduce+ Go to Manage add-ons - All add-ons - jira-importers-plugin - Enable JSON export Create an SD request and add one internal...
NIST Recommends SMS Two-Factor Authentication Deprecation
A U.S. government agency said the end is nigh for SMS-based two-factor authentication, citing a lack of security around the feature. The latest draft version of the Digital Authentication Guideline issued this week by the U.S. National Institute for Standards and Technology NIST said the practice...
WordPress WP Advanced Comment Plugin HTML Injection Vulnerability
WordPress is a suite of blogging platforms developed in the PHP language by the WordPress Software Foundation.WP Advanced Comment is one of the Ajax-based comment plugins. An HTML injection vulnerability exists in the WordPress WP Advanced Comment plugin. An attacker can exploit this vulnerabilit...
The vulnerability of the libxml2 library allows attackers to obtain confidential information, cause service failures, or exert other types of damage.
The vulnerability of the htmlParseComment function in the libxml2 library is caused by buffer overflow. Exploiting this vulnerability could allow an attacker to obtain confidential information, cause service failure termination of the application, or have other effects through an unclosed HTML...
The vulnerability of the enterprise automation system 1C:Enterprise allows a malicious individual to trigger service failures or execute arbitrary codes.
The automation system of the enterprise 1C:Enterprise contains a vulnerability in the Fast Infoset decoder of the XML document handling library xml2.dll. A malicious individual, by manipulating input data, can set the Fast Infoset decoder to the CIIUTF8LARGELENGTH state for processing a single...
DEBIAN-CVE-2016-5704
Cross-site scripting XSS vulnerability in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving a comment...