5606 matches found
CVE-2020-15276: Improper Neutralization of Input During Web Page Generation
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1...
PT-2020-14333
Name of the Vulnerable Software and Affected Versions baserCMS versions 4.0.0 through 4.4.0 Description The issue affects the blog comment component, allowing arbitrary JavaScript execution by entering a crafted nickname in blog comments. This can lead to Cross-Site Scripting XSS via arbitrary...
Withdrawn: HTTP Request Smuggling in Agoo
Withdrawn reason Withdrawn on 1/13/2021 due to this comment from the maintainer. This is no longer considered a vulnerability. Original description agoo through 2.12.3 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. It is possible to...
Comment Press < 2.7.2 - Unauthenticated Cross-Frame Scripting
An Unauthenticated Cross-Frame Scripting vulnerability was discovered in the Comment Press plugin v2.7.0 for WordPress. PoC ! :: PoC Burp Suite: POST /wp-comments-post.php HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest...
Comment Press < 2.7.2 - Unauthenticated Cross-Frame Scripting
An Unauthenticated Cross-Frame Scripting vulnerability was discovered in the Comment Press plugin v2.7.0 for WordPress. ! :: PoC Burp Suite: POST /wp-comments-post.php HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest...
WordPress Comment Press premium plugin <= 2.7.0 - Unauthenticated Cross-Frame Scripting (XSS) vulnerability
Unauthenticated Cross-Frame Scripting XSS vulnerability found by Ex.Mi in WordPress Comment Press premium plugin versions = 2.7.0. Solution Update the WordPress Comment Press premium plugin to the latest available version at least 2.7.2...
Automattic: Able to comment/view in others support ticket at https://en.instagram-brand.com/requests/dashboard
Summary: I reported the vulnerability to Facebook, and they have said to report it here for the bounty. Platforms Affected: https://en.instagram-brand.com/requests/dashboard Steps To Reproduce: 1. Create two account User A, User B at https://en.instagram-brand.com/ 2. Apply for Instagram brand fr...
Design/Logic Flaw
An issue was discovered in Secudos Qiata FTA 1.70.19. The comment feature allows persistent XSS that is executed when reading transfer comments or the global notice board...
CVE-2020-14294
An issue was discovered in Secudos Qiata FTA 1.70.19. The comment feature allows persistent XSS that is executed when reading transfer comments or the global notice board...
CVE-2020-14294: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Secudos Qiata FTA 1.70.19. The comment feature allows persistent XSS that is executed when reading transfer comments or the global notice board...
PT-2020-13961
Name of the Vulnerable Software and Affected Versions Secudos Qiata FTA version 1.70.19 Description An issue was discovered that allows persistent XSS, which is executed when reading transfer comments or the global notice board, due to a flaw in the comment feature. Recommendations For Secudos...
CVE-2020-13325
A vulnerability was discovered in GitLab versions prior 13.1. The comment section of the issue page was not restricting the characters properly, potentially resulting in a denial of service...
Code injection
A vulnerability was discovered in GitLab versions prior 13.1. The comment section of the issue page was not restricting the characters properly, potentially resulting in a denial of service...
Mail.ru: [delivery.city-mobil.ru] Stored XSS into support request comment
Stored XSS in support request comment functionality on delivery.city-mobil.ru Citymobil corporate user could use delivery.city-mobil.ru API for submitting data. It led to bypass input-encoding filters of corporate.city-mobil.ru and stored XSS appeared at corporate.city-mobil.ru...
CVE-2020-13325
A vulnerability was discovered in GitLab versions prior 13.1. The comment section of the issue page was not restricting the characters properly, potentially resulting in a denial of service...
CVE-2020-13325
Removed by vendor...
CVE-2020-13325: Undefined Security Weakness
A vulnerability was discovered in GitLab versions prior 13.1. The comment section of the issue page was not restricting the characters properly, potentially resulting in a denial of service...
Information Disclosure
johnpbloch/wordpress-core is vulnerable to information disclosure. The vulnerability exists in the getcommentexcerpt function in comment-template.php because the comments from password-protected non-public posts and pages are not restricted from viewing under certain conditions...
WordPress Comment Mismanagement Vulnerability
WordPress is a blogging platform developed using the PHP language. Users can set up their own websites on servers that support PHP and MySQL databases, or use WordPress as a content management system CMS. A comment mismanagement vulnerability exists in wp-includes/comment-template.php in WordPres...