5603 matches found
PT-2020-20267
Name of the Vulnerable Software and Affected Versions Pega Platform versions prior to 8.2.6 Description The issue is related to a Stored Cross-Site Scripting XSS vulnerability in the comment tags. Recommendations For versions prior to 8.2.6, update to version 8.2.6 or later to resolve the issue...
CVE-2020-8775: Improper Neutralization of Input During Web Page Generation
Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting XSS vulnerability in the comment tags...
php: Heap buffer over-read in exif_process_user_comment()
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exifreaddata function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information...
WordPress WP GDPR plugin <= 2.1.1 - Unauthenticated Arbitrary Comment Deletion vulnerability
Unauthenticated Arbitrary Comment Deletion vulnerability discovered by NinTechNet in WordPress WP GDPR plugin versions = 2.1.1. Solution This plugin has been closed as of October 23, 2019 and is not available for download. Reason: Security Issue...
apostrophe-tumblr (>=0.5.1, <=0.5.13), http-teapot-comment (0.1.0) +1 more potentially affected by CVE-2016-1000237 via sanitize-html (>=1.1.4, <=1.4.2)
sanitize-html NPM version =1.1.4, =0.5.1, =0.5.13 - http-teapot-comment 0.1.0 - piedpiper-middle-out 5.8.1 Source cves: CVE-2016-1000237 Source advisory: OSV:GHSA-3J7M-HMH3-9JMP...
CVE-2019-19500
Matrix42 Workspace Management 9.1.2.2765 and below allows stored XSS via unfiltered description parameters, as demonstrated by the comment field of a special order for individual software...
CVE-2019-19500
CVE-2019-19500 affects Matrix42 Workspace Management 9.1.2.2765 and earlier. The vulnerability is a stored XSS in unfiltered description parameters of the WEB application (e.g., the comment field of a special software order). Root cause: lack of proper validation of client‑side data by the applic...
PT-2020-10172
Name of the Vulnerable Software and Affected Versions Matrix42 Workspace Management versions 9.1.2.2765 and below Description The issue allows stored XSS via unfiltered description parameters, as demonstrated by the comment field of a special order for individual software. This can be exploited...
CVE-2019-19500: Improper Neutralization of Input During Web Page Generation
Matrix42 Workspace Management 9.1.2.2765 and below allows stored XSS via unfiltered description parameters, as demonstrated by the comment field of a special order for individual software...
WSO2 3.1.0 - Persistent Cross-Site Scripting Vulnerability
Exploit for java platform in category web applications Title: WSO2 3.1.0 - Persistent Cross-Site Scripting Author: raki ben hamouda Vendor: https://apim.docs.wso2.com Softwrare link: https://apim.docs.wso2.com/en/latest/ CVE: N/A Advisory:...
WSO2 3.1.0 - Persistent Cross-Site Scripting
Title: WSO2 3.1.0 - Persistent Cross-Site Scripting Date: 2020-04-13 Author: raki ben hamouda Vendor: https://apim.docs.wso2.com Softwrare link: https://apim.docs.wso2.com/en/latest/ CVE: N/A Advisory: https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0700 Technical Details &...
MS15-081: Description of the security update for Word 2013: August 11, 2015
Resolves vulnerabilities in Office that could allow remote code execution if a user opens a specially crafted Microsoft Office file.SummaryThis security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Microsoft Office...
Arbitrary Code Execution
gstreamer-plugins-base is vulnerable to arbitrary code execution. An integer overflow flaw which caused a heap-based buffer overflow was discovered in the Vorbis comment tags reader. An attacker could create a carefully-crafted Vorbis file that would cause an application using GStreamer to crash...
Information Disclosure in comment restriction feature - CVE-2019-20410
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in the comment restriction feature. Affected versions: version 7.6.17 7.7.0 ≤ version 7.13.9 8.0.0 ≤ version 8.4.2 Fixed versions: 7.6.17...
CVE-2019-19091
For ABB eSOMS versions 4.0 to 6.0.3, HTTPS responses contain comments with sensitive information about the application. An attacker might use this detail information to specifically craft the attack...
Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-18334)
Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflective cross-site scripting vulnerability exists in admin/edit-comment.php in Chadha PHPKB Standard Multi-Language version 9...
CVE-2020-10503
CSRF in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to disapprove any comment, given the id, via a crafted request...
CVE-2020-10504
CSRF in admin/edit-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a comment, given the id, via a crafted request...
