CVE-2022-0279 AnyComment < 0.2.18 - Comment Rating Increase/Decrease via Race Condition

The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user to quickly raise their rating or lower the rating of other users...

CVE-2022-24585

A stored cross-site scripting XSS vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the author parameter...

UBUNTU-CVE-2022-24585

A stored cross-site scripting XSS vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the author parameter...

ScratchOAuth2 安全漏洞

Kenny2github ScratchOAuth2 is a Kenny2github open source application. Verify that a Scratch account is authentic for authorization or identification purposes. ScratchOAuth2 has a security vulnerability that stems from a problem with authentication in ScratchOAuth2's SOA2Login::comment, allowing a...

Improper Authorization in chocobozzz/peertube

Description The app doesn't check the status of video when making data changes. Normal users can create new comment or reply comment in private videos. Proof of Concept note: I'm using instance p.lu for testing - Step 1: Login as video test1 and upload private video. Get video ID of private video...

Improper Access Control in liangliangyy/djangoblog

Description "formvalid" function in comments/views.py file performs the task of saving user comments. However, this function doesn't check the status of article, so users can leave comments on draft article or public article with commentstatus is off. Proof of Concept - Step 1: Login as admin in...

Improper Access Control in publify/publify

Description Article in draft mode can only be accessed by admins who have permission to manage article. Anonymous users can't view but can leave comments on article in draft mode. The cause of the vulnerability is that the draft article is setting to comment enabled and createcomment function onl...

Improper Privilege Management in liangliangyy/djangoblog

Description Hi there, I would like to report an improper privilege management vulnerability in djangoblog source code. This would allow an attacker to create comment on behalf of anyone. Proof of Concept 1. Install a local instance of djangoblog, login as admin and create an article 2. Create a n...

CVE-2022-23889

The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments...

CVE-2022-23889

The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments...

CVE-2022-23888

YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey CSRF via the component /yzmcms/comment/index/init.html...

Code injection

The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments...

CVE-2022-23889

The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments...

CVE-2022-23889

The CVE-2022-23889 entry concerns YzmCMS v6.3 where the comment function can be operated concurrently, enabling an attacker to generate an unusually large number of comments. The core issue is a race/concurrency condition in the comment handling code, leading to potential resource exhaustion or i...

CVE-2022-23889

The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments...

CVE-2022-23888

YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey CSRF via the component /yzmcms/comment/index/init.html...

CVE-2022-23888

YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey CSRF via the component /yzmcms/comment/index/init.html...

Yzmcms 跨站请求伪造漏洞

Yzmcms is an open source CMS Content Management System for Yzmcms personal developers. YzmCMS v6.3 is vulnerable to cross-site request forgery, which can be exploited by attackers to trigger cross-site request forgery CSRF via the component /yzmcms/comment/index/init.html...

WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones either intentionnaly or not and lead to Stored Cross-Site Scripting issues PoC Import the following CSV as comment:...

cve_tracking

cvetracking 介绍 cve 补丁自动获取工具，该工具将会根据 cve 和 rpm 包自动在上游社区查找补丁并反馈结果，同时也可以下载查找到的补丁以及验证补丁的可用性。 软件架构 python 可执行代码 安装教程 1. 下载代码 shell git clone https://gitee.com/openeuler/cve-manager.git 2. 进入工具执行目录 shell cd xxx上述代码下载目录/cve-manager/cve-agency-manager/cvetracking 3. 在 cve-tracking.yaml 的 authentication 中...