CVE-2020-20521

Cross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the comment parameter...

PT-2023-11554 · Kitecms · Kitecms

Name of the Vulnerable Software and Affected Versions: KiteCMS version 1.1 Description: A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the comment parameter. Recommendations: For KiteCMS version 1.1, avoid using the comment parameter until a fix is available. ...

WordPress Comment Reply Notification Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Comment Reply Notification Type Plugin Vulnerable versions = 1.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25051 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fac19e90ec15 Credits Mika Require...

SUSE CVE-2021-33641

When processing files, malloc stores the data of the current line. When processing comments, malloc incorrectly accesses the released memory use after free...

PT-2023-9824 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 17.6.0 Description: The issue is related to insufficient protection of service data when adding non-image attachments, resulting in a lack of authentication procedure. This allows a remote attacker to bypass...

CVE-2023-28154

A flaw was found in the webpack package, which could allow a remote attacker to bypass security restrictions caused by the mishandling of the magic comment feature by the ImportParserPlugin.js. This flaw allows an attacker to gain access to the real global object by sending a specially-crafted...

CVE-2023-27711

Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via the Comment Manager /admin/manage-comments.php component...

Cross site scripting

Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via the Comment Manager /admin/manage-comments.php component...

PT-2023-21306 · Typecho · Typecho

Name of the Vulnerable Software and Affected Versions: Typecho version 1.2.0 Description: A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the Comment Manager component, specifically through the "/admin/manage-comments.php" API endpoint. This enables the attacke...

CVE-2023-27711

Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via the Comment Manager /admin/manage-comments.php component...

CVE-2023-27711

Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via the Comment Manager /admin/manage-comments.php component...

CVE-2023-27711

CVE-2023-27711 is a documented Cross Site Scripting vulnerability in Typecho v1.2.0 affecting the Comment Manager via the /admin/manage-comments.php endpoint. The issue enables a remote attacker to execute arbitrary code in the context of the affected app. Public documents consistently describe t...

CVE-2023-27711

Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via the Comment Manager /admin/manage-comments.php component...

Sensitive Information Disclosure

webpack is vulnerable to Sensitive Information Disclosure. The vulnerability exists because ImportParserPlugin.js does not restrict cross-realm object access and mishandles the magic comment feature, allowing an attacker who controls a property of an untrusted object to obtain access to the real...

The vulnerability of the Kostac PLC Programming Software (formerly Koyo PLC Programming Software) relates to the execution of operations beyond the buffer boundaries in memory. This allows an intruder to gain unauthorized access to protected information or execute arbitrary code.

The vulnerability of the Kostac PLC Programming Software formerly Koyo PLC Programming Software relates to the execution of an operation beyond the buffer boundaries in memory when processing a comment block within the project file information. Exploiting this vulnerability can allow an intruder ...

Atlassian Jira 8.6.0 < 8.6.1 Comment Permissions Broken Access Control

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to version 7.13.12, 8.0.0 prior to 8.5.4 or 8.6.0 prior to 8.6.1. It is, therefore, affected by a vulnerability which permits remote attackers to make comments on a ticket to whi...

Atlassian Jira 7.7.0 < 7.13.9 Information Disclosure In Comment Restriction Feature

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.0. It is, therefore, affected by a vulnerability which permits remote attackers to view sensitive information via an Information Disclosure vulnerability in the comment...

Atlassian Jira 8.0.0 < 8.4.2 Information Disclosure In Comment Restriction Feature

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.0. It is, therefore, affected by a vulnerability which permits remote attackers to view sensitive information via an Information Disclosure vulnerability in the comment...

Atlassian Jira 7.13.0 < 7.6.17 Information Disclosure In Comment Restriction Feature

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.0. It is, therefore, affected by a vulnerability which permits remote attackers to view sensitive information via an Information Disclosure vulnerability in the comment...

Cross-realm object access in Webpack 5

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object...