5606 matches found
CVE-2020-35598
ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advancedcomponentsystem/index.php?ACSpath=..%2f URI. NOTE: this might be the same as CVE-2009-4623...
CVE-2020-35598
ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advancedcomponentsystem/index.php?ACSpath=..%2f URI. NOTE: this might be the same as CVE-2009-4623...
Directory traversal
ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advancedcomponentsystem/index.php?ACSpath=..%2f URI. NOTE: this might be the same as CVE-2009-4623...
CVE-2020-35598
ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advancedcomponentsystem/index.php?ACSpath=..%2f URI. NOTE: this might be the same as CVE-2009-4623...
CVE-2020-35598
ACS Advanced Comment System 1.0 is affected by Local File Inclusion/Directory Traversal via advanced_component_system/index.php?ACS_path=..%2f. The Nuclei template and Exploit-DB entry confirm path traversal can lead to viewing sensitive files (e.g., /etc/passwd) and indicate potential remote cod...
PT-2020-17357
Name of the Vulnerable Software and Affected Versions ACS Advanced Comment System version 1.0 Description The issue allows Directory Traversal via the advanced component system/index.php API endpoint, specifically through the ACS path variable. This can be exploited by manipulating the ACS path...
CVE-2020-35598: Improper Limitation of a Pathname to a Restricted Directory
ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advancedcomponentsystem/index.php?ACSpath=..%2f URI. NOTE: this might be the same as CVE-2009-4623...
Ueeshop comment section has XSS vulnerability
Ueeshop provides e-commerce website building cross-border independent station building platform. Ueeshop comment area there is an XSS vulnerability, attackers can use the vulnerability to implant malicious js code, such as stealing cookies hanging horse and other operations...
Advanced Comment System Path Traversal Vulnerability
Advanced Comment System is an advanced comment system. ACS Advanced Comment System 1.0 suffers from a path traversal vulnerability that originates in index.php, an advanced component system...
CVE-2020-35625
An issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the ability to edit pages within the Widgets namespace could call any static function within any class defined within PHP or MediaWiki via a crafted HTML comment, related to a Smarty template. For example...
CVE-2020-35625
An issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the ability to edit pages within the Widgets namespace could call any static function within any class defined within PHP or MediaWiki via a crafted HTML comment, related to a Smarty template. For example...
CVE-2020-35625
CVE-2020-35625 affects the MediaWiki Widgets extension (versions up to 1.35.1). A crafted HTML comment in the Widgets namespace can trigger execution of arbitrary static functions defined in PHP/MediaWiki via a Smarty template, enabling potential code execution for users able to edit Widgets page...
CVE-2020-35625: Missing Authorization
An issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the ability to edit pages within the Widgets namespace could call any static function within any class defined within PHP or MediaWiki via a crafted HTML comment, related to a Smarty template. For example...
PT-2020-17372 · Mediawiki +1 · Mediawiki +2
Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.35.1 Widgets extension for MediaWiki versions through 1.35.1 Description: An issue was discovered in the Widgets extension for MediaWiki, where any user with the ability to edit pages within the Widgets namespace...
Unauthorized Base Repository Modification And Secrets Exfiltration
functionsframework is vulnerable to unauthorized base repository modification or secret exfiltration. The vulnerability exists because an action's token is not granted with enough permissions to write to the PR when the PR is opened from a fork and the commit message failed, causing the checkers...
Cross-site Scripting (XSS)
phpoffice/phpspreadsheet is vulnerable to cross-site scripting XSS. The vulnerability exists when creating a HTML output using an excel cell, through a comment on any cell, as the comments gets concatenated as part of the link...
CVE-2020-7776 Cross-site Scripting (XSS)
This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is...
MISP cross-site scripting vulnerability (CNVD-2021-08162)
MISP is an open source software solution for collecting, storing, distributing and sharing cybersecurity metrics and threats related to cybersecurity event analysis and malware analysis. A cross-site scripting vulnerability exists in...
Automattic: [intensedebate.com] No Rate Limit On The report Functionality Lead To Delete Any Comment When it is enabled
Hello Summary: I have found a no rate limit issue on the report functionality. When you enabled the report functionality on your site, you can set a number of reports before deleting the comment reported. By default, this functionality is unable, but if you enabled this and you set a $x number of...