4030 matches found
GHSA-M9HP-7R99-94H5 Critical security issues in XML encoding in github.com/dexidp/dex
Impact The following vulnerabilities have been disclosed, which impact users leveraging the SAML connector: Signature Validation Bypass CVE-2020-15216: https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7 encoding/xml instabilities: - Element namespace prefix...
GlFusion Cms 访问控制错误漏洞
glFusion CMS is a content management and publishing system. glFusion CMS v1.7.9 is vulnerable to an access control error, which can be exploited by attackers via /publichtml/comment.php...
CVE-2021-39918
Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows a user to add comments to a vulnerability which cannot be accessed...
Comment Engine Pro <= 1.0 - Editor+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some parameters, allowing high privilege users such as editor and above to perform Stored Cross-Site Scripting attacks...
CVE-2021-36911
Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Comment Engine Pro plugin versions = 1.0, could be exploited by users with Editor or higher role...
CVE-2021-36911
Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Comment Engine Pro plugin versions = 1.0, could be exploited by users with Editor or higher role...
Cross site scripting
Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Comment Engine Pro plugin versions = 1.0, could be exploited by users with Editor or higher role...
CVE-2021-36911 WordPress Comment Engine Pro plugin <= 1.0 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Comment Engine Pro plugin versions = 1.0, could be exploited by users with Editor or higher role...
CVE-2021-36911
CVE-2021-36911 affects WordPress Comment Engine Pro plugin
WordPress 跨站脚本漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin that stems from a stored cross-site...
Stars Rating < 3.5.1 - Comments Denial of Service
The plugin does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the comments section, or pending comment dashboard depending if the user sent it as unauthenticated or authenticated. Enable rating for a post/page, add a comment, capture the...
PT-2021-6388
Name of the Vulnerable Software and Affected Versions Microsoft Office Visio affected versions not specified Description The issue is related to errors in handling EMR COMMENT EMFPLUS records in EMF files, which can lead to untrusted pointer dereference. This can allow an attacker to execute...
OX App Suite 7.10.5 Cross Site Scripting / Information Disclosure Vulnerability
OX App Suite versions 7.10.5 and below suffer from cross site scripting and information disclosure vulnerabilities. Product: OX App Suite Vendor: OX Software GmbH Internal reference: OXUIB-872 Vulnerability type: Cross-Site Scripting CWE-80 Vulnerable version: 7.10.5 and earlier Vulnerable...
All Vulnerabilities for nhvrinweb.sos.nh.gov Patched via Open Bug Bounty
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| nhvrinweb.sos.nh.gov ---|--- Open Bug...
Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk
Description Stored XSS via Markdown at Description or Comment of Ticket Detail When rendering to Markdown, the application does not filter and check the properties are valid, so when the user enters XSS it will render as XSS . Proof of Concept // PoC.req POST /tickets/submit/ HTTP/1.1 Host:...
CVE-2021-41165
CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result...
CVE-2021-24806 wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF
The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make...
WordPress 插件跨站请求伪造漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress Plugin is a WordPress open source application plugin. cross-site request forgery vulnerability exists in...
CVE-2021-38488
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter comment of the API events, which may allow an attacker to remotely execute code...