PYSEC-2021-333

sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. On...

PYSEC-2021-333

sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. On...

WordPress Comment and Review Spam Control for WooCommerce plugin <= 1.4.1 - Multiple vulnerabilities

Multiple vulnerabilities Authenticated Arbitrary WordPress Options Change, Read and Deletion / Authenticated User Enumeration / Authenticated Plugin Settings Change, Import and Export were discovered by Jerome Bruandet NinTechNet in WordPress Comment and Review Spam Control for WooCommerce plugin...

CVE-2021-3801

Insufficient Regular Expression Complexity in prismjs leads to a Regular Expression Denial of Service ReDoS attack. An unauthenticated attacker can exploit this flaw to cause an application to consume an excess amount of CPU by providing a crafted HTML comment as input. This can result in a denia...

All Vulnerabilities for santanderbank.com Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| santanderbank.com ---|--- Open Bug Boun...

PT-2021-21938

Name of the Vulnerable Software and Affected Versions: Prism affected versions not specified Description: The issue concerns Inefficient Regular Expression Complexity, also known as ReDoS regular expression denial of service. An attacker can cause an application to consume excessive CPU by...

php:php-fuzz-exif: Heap-buffer-overflow in _estrdup

Detailed Report: https://oss-fuzz.com/testcase?key=5306547874430976 Project: php Fuzzing Engine: afl Fuzz Target: php-fuzz-exif Job Type: aflasanphp Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x60400045bdfe Crash State: estrdup exifprocessusercomment...

CVE-2021-24725

The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its 'Delete comments easily', which could allow attackers to make logged in admin delete arbitrary comments...

CVE-2021-24725 Comment Link Remove and Other Comment Tools < 2.1.6 - Arbitrary Comment Deletion via CSRF

The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its 'Delete comments easily', which could allow attackers to make logged in admin delete arbitrary comments...

unicaen.fr Cross Site Scripting vulnerability OBB-2139397

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| unicaen.fr ---|--- Open Bug Bounty...

PT-2021-16228

Name of the Vulnerable Software and Affected Versions Comment Link Remove and Other Comment Tools WordPress plugin versions prior to 2.1.6 Description The issue concerns the lack of a CSRF check in the 'Delete comments easily' feature, which could allow attackers to trick logged-in admins into...

CVE-2021-24725: Cross-Site Request Forgery (CSRF)

The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its 'Delete comments easily', which could allow attackers to make logged in admin delete arbitrary comments...

blazingseollc.com Cross Site Scripting vulnerability OBB-2138815

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| blazingseollc.com ---|--- Open Bug Boun...

Inefficient Regular Expression Complexity in prismjs/prism

✍️ Description The prismjs package is vulnerable to ReDoS regular expression denial of service. An attacker that is able to provide a crafted HTML comment as input may cause an application to consume an excessive amount of CPU. Below pinned line using vulnerable regex. 🕵️‍♂️ Proof of Concept...

JEESNS Stored Cross-Site Scripting Vulnerability (CNVD-2021-74054)

JEESNS is a social management system developed on the JAVA enterprise platform. The vulnerability can be exploited to execute arbitrary Web script or HTML via a specially crafted payload in the "group comment" text field...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the /weibo/comment component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Weibo comment section...

CVE-2020-19290

A stored cross-site scripting XSS vulnerability in the /weibo/comment component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Weibo comment section...

PT-2021-10334

Name of the Vulnerable Software and Affected Versions: Jeesns version 1.4.2 Description: A stored cross-site scripting XSS issue in the /article/comment component allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the article comments section. Recommendations: For...

PT-2021-10330

Name of the Vulnerable Software and Affected Versions: Jeesns version 1.4.2 Description: A stored cross-site scripting XSS issue in the /weibo/comment component allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Weibo comment section. Recommendations: For Jeesn...

PT-2021-10324

Name of the Vulnerable Software and Affected Versions: Jeesns version 1.4.2 Description: A stored cross-site scripting XSS issue in the /group/comment component allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the group comments text field. This can be achieved b...