Xwiki CMS 12.10.2 - Cross Site Scripting (XSS)

Exploit Title: Xwiki CMS 12.10.2 - Cross Site Scripting XSS Date: 17-01-2021 Exploit Author: Karan Keswani Vendor Homepage: https://www.xwiki.org/xwiki/bin/view/Main/WebHome Software Link: https://www.xwiki.org/xwiki/bin/view/Download/ Version: Xwiki CMS- 12.10.2 Tested on: Windows 10 Description...

Xwiki CMS 12.10.2 Cross Site Scripting

Exploit Title: Xwiki CMS 12.10.2 - Cross Site Scripting XSS Date: 17-01-2021 Exploit Author: Karan Keswani Vendor Homepage: https://www.xwiki.org/xwiki/bin/view/Main/WebHome Software Link: https://www.xwiki.org/xwiki/bin/view/Download/ Version: Xwiki CMS- 12.10.2 Tested on: Windows 10 Description...

Server-Side Template Injection (SSTI)

pwntools is vulnerable to server-side template injection. An attacker is able to inject and execute arbitrary code via the Shellcraft generation due to insecure parsing of strings that containing end of multiline comment...

Mail.ru: Stored XSS on store.my.games

Stored XSS in comment viewing functionality on store.my.games...

CVE-2019-16954

SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket...

CVE-2019-16954

CVE-2019-16954 affects SolarWinds Web Help Desk 12.7.0 with an HTML injection vulnerability via the Comment in a Help Request ticket. The provided connected documents indicate the flaw is caused by accepting user input in a Comment and injecting it into HTML, but do not provide explicit exploit s...

SolarWinds Web Help Desk 注入漏洞

SolarWinds Web Help Desk is a web-based help desk work order and IT asset management software. An HTML injection vulnerability exists in SolarWinds Web Help Desk 12.7.0. The vulnerability can be exploited to conduct an HTML injection attack via a Comment in a Help Request work order...

CVE-2019-16954: Improper Neutralization of Input During Web Page Generation

SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket...

CVE-2021-3026

CVE-2021-3026 affects Invision Community IPS Community Suite prior to 4.5.4.2 and enables cross-site scripting during the quoting of a post or comment. The issue is described as XSS in the quoting workflow, with multiple external records corroborating the vulnerability. The provided documents do ...

CVE-2021-3026: Improper Neutralization of Input During Web Page Generation

Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment...

CVE-2016-20002

The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy...

CVE-2016-20002

The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy...

Design/Logic Flaw

The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy...

Drupal Security Vulnerabilities

Drupal is an open source content management system developed in PHP by the Drupal community. A security vulnerability exists in Drupal REST/JSON project 7.x-1.x that allows comment access bypass...

CVE-2016-20002

The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy...

UBUNTU-CVE-2020-12658

DISPUTED gssproxy aka gss-proxy before 0.8.3 does not unlock condmutex before pthread exit in gpworkermain in gpworkers.c. NOTE: An upstream comment states "We are already on a shutdown path when running the code in question, so a DoS there doesn't make any sense, and there has been no additional...

PT-2020-8021

Name of the Vulnerable Software and Affected Versions: REST/JSON project for Drupal version 7.x-1.x Description: The issue allows comment access bypass. This project is not covered by Drupal's security advisory policy. Recommendations: For version 7.x-1.x, update to a version that includes the fi...

CVE-2016-20002: Incorrect Authorization

The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy...

h1-ctf: HackyHolidays H1 CTF Writeup

HackyHolidays Day 1 Once the CTF started and the Grinch released the scope hackyholidays.h1ctf.com, I started the CTF by a good old Nmap scan, to see whats running on the server. So the nmap command looked like nmap -sC -sV -oA nmap hackyholidays.h1ctf.com/. The result showed a promising entry...

Unspecified vulnerability in MediaWiki (CNVD-2021-09326)

MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. It can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in MediaWiki version 1.35.1 and earlier...