CVE-2024-12664: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, has been found in ruifang-tech Rebuild 3.8.5. This issue affects some unknown processing of the component Project Task Comment Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2024-54404: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Nazmul Ahsan MDC Comment Toolbar mdc-comment-toolbar allows Stored XSS.This issue affects MDC Comment Toolbar: from n/a through = 1.1...

PT-2024-17705 · Ruifang Tech · Ruifang-Tech Rebuild

Name of the Vulnerable Software and Affected Versions: ruifang-tech Rebuild version 3.8.5 Description: A problematic issue has been found in the Project Task Comment Handler component, leading to cross-site scripting. The attack can be initiated remotely. The exploit has been disclosed to the...

Unbreakable Enterprise kernel security update

5.4.17-2136.338.4.1 - Revert 'ocfs2: fix the la space leak when unmounting an ocfs2 volume' Sherry Yang Orabug: 37383196 5.4.17-2136.338.4 - devlink: fix possible use-after-free and memory leaks in devlinkinit Vasiliy Kovalev Orabug: 37284641 CVE-2024-26734 - mm: avoid leaving partial pfn mapping...

PT-2024-36648 · 搜狐畅言 · 搜狐畅言

Name of the Vulnerable Software and Affected Versions: 搜狐畅言 畅言评论系统 versions n/a through 2.0.5 Description: The issue is related to a missing authorization vulnerability that allows the exploitation of incorrectly configured access control security levels. Recommendations: For versions n/a through...

WordPress 畅言评论系统 plugin <= 2.0.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin 畅言评论系统 versions = 2.0.5...

CVE-2023-44147

Missing Authorization vulnerability in apasionados Comment Blacklist Updater comment-blacklist-updater allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comment Blacklist Updater: from n/a through = 1.1.0...

CVE-2023-44147 WordPress Comment Blacklist Updater plugin <= 1.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in apasionados Comment Blacklist Updater comment-blacklist-updater allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comment Blacklist Updater: from n/a through = 1.1.0...

CVE-2023-44147 WordPress Comment Blacklist Updater plugin <= 1.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in apasionados Comment Blacklist Updater comment-blacklist-updater allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comment Blacklist Updater: from n/a through = 1.1.0...

CVE-2023-44147: Missing Authorization

Missing Authorization vulnerability in apasionados Comment Blacklist Updater comment-blacklist-updater allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comment Blacklist Updater: from n/a through = 1.1.0...

PT-2024-13175 · Unknown · Comment Blacklist Updater

Name of the Vulnerable Software and Affected Versions: Comment Blacklist Updater versions 1.1.0 and earlier Description: The issue is related to missing authorization, allowing exploitation of incorrectly configured access control security levels due to broken access control. This can be exploite...

WordPress MDC Comment Toolbar plugin <= 1.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin MDC Comment Toolbar versions = 1.1...

Directus has an HTML Injection in Comment

Summary The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. Details The Comment feature implements a...

GHSA-R6WX-627V-GH2F Directus has an HTML Injection in Comment

Summary The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. Details The Comment feature implements a...

CVE-2024-54128

Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application...

CVE-2024-54128 Directus has an HTML Injection in Comment

Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application...

CVE-2024-54128 Directus has an HTML Injection in Comment

Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application...

CVE-2024-54128 Directus has an HTML Injection in Comment

Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application...

CVE-2024-54128

Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application...

Infinite loop

Overview drupal/core is an an open source content management platform powering millions of websites and applications. Affected versions of this package are vulnerable to Infinite loop via the Comment module. An attacker can trigger excessive resource consumption by making repeated comment reply...