DRUPAL-CORE-2018-001

This security advisory fixes multiple vulnerabilities in both Drupal 7 and Drupal 8. See below for a list. Comment reply form allows access to restricted content - Critical - Drupal 8 - CVE-2017-6926 Users with permission to post comments are able to view content and comments they do not have...

drupal -- Drupal Core - Multiple Vulnerabilities

Drupal Security Team reports: CVE-2017-6926: Comment reply form allows access to restricted content CVE-2017-6927: JavaScript cross-site scripting prevention is incomplete CVE-2017-6928: Private file access bypass - Moderately Critical CVE-2017-6929: jQuery vulnerability with untrusted domains -...

Comment reply form allows access to restricted content.

More info at https://www.drupal.org/SA-CORE-2018-001...

Comment reply form allows access to restricted content.

More info at https://www.drupal.org/SA-CORE-2018-001...

CVE-2017-18092

The print snippet resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a comment on the snippet...

CVE-2018-6845

PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field...

Design/Logic Flaw

PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field...

CVE-2018-6845

PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field...

CVE-2018-6845

PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field...

CVE-2018-6845

The CVE-2018-6845 entry concerns PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 and a Cross-Site Scripting (XSS) vulnerability exposed via the Leave Comment field. The CNVD/NVD records confirm a stored/reflected XSS pathway where user-supplied input in comments can inject arbitrary script...

PT-2018-17773

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Multi Language Olx Clone Script version 2.0.6 Description The issue concerns a problem where an attacker can inject malicious code via the Leave Comment field, potentially leading to security breaches. Recommendations For PHP...

CVE-2018-6845: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field...

Multi Language Olx Clone Script - Cross-Site Scripting

Exploit Title: Multi Language Olx Clone Script - Stored XSS Date: 08.02.2018 Exploit Author: Varun Bagaria Web: Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/olx-clone/ Category: Web Application Version:2.0.6 Tested on: Windows 7 CVE: NA...

PT-2018-17769

Name of the Vulnerable Software and Affected Versions Wireshark versions prior to 2.4.5 Description The issue is related to the netmonrec comment destroy function in wiretap/netmon.c, which performs a free operation on an uninitialized memory address. This allows remote attackers to cause a denia...

CVE-2017-9513

Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & receive notifications when comments are added to the watched page, and vote & watch JIRA issues that they do not have access to, although th...

Valve: Read Access to all comments on unauthorized forums' discussions! IDOR!

hi, For a forum's discussion, only moderator+ ranks are allowed to view comments which have been deleted by a officer/moderator . I have found an issue where a member who is not allowed to view deleted comments can get read access to the deleted comments on a forum's discussion. Also, a non-membe...

CVE-2018-5370

BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI...

CVE-2018-5370

BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI...

Design/Logic Flaw

BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI...

CVE-2018-5370

CVE-2018-5370 affects BizLogic xnami 1.0, a PHP-based image sharing script. The issue is a Cross-Site Scripting (XSS) vulnerability via the comment parameter in the addComment action to the /media/ajax URI. The root cause is insufficient input sanitization on the comment field, enabling injection...