4023 matches found
ExpressionEngine: Open Redirect in comment section
@winst0n13 discovered that the URL you are redirected to after successfully submitting a comment could be modified in certain circumstances. @winst0n13 gave a detailed report with step-by-step instructions for replicating, enabling a speedy resolution to the issue...
WordPress Nya-Comment-DoFollow Plugin Cross-Site Request Forgery Vulnerability
WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. A cross-site request forgery vulnerability exists in the WordPress Nya-Comment-DoFollow...
WordPress Nya-Comment-DoFollow 1.0 Open Redirection
Exploit Title : WordPress Nya-Comment-DoFollow Plugins 1.0 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 29/05/2019 Vendor Homepage : wordpress.com Information Link : muzhiks.com/nyacommentsdofolloweng WordPress Affected Versions : 2.6.x, 2.5....
WordPress WPGraphQL Access Control Error Vulnerability
WPGraphQL is a free open source WordPress plugin that provides an extensible GraphQL architecture and API for any WordPress site. WordPress WPGraphQL suffers from an Access Control Error vulnerability that can be exploited by an attacker to post a comment on any post...
XSS Vulnerability at JEESNS Microblog Comments
JEESNS is an open source social management system developed on the JAVA enterprise level platform. JEESNS microblogging comments at the existence of XSS vulnerability , an attacker can use the vulnerability to inject arbitrary Web script or HTML...
doorGets SQL Injection Vulnerability (CNVD-2019-13796)
DoorGets is a free and open source content management system. A SQL injection vulnerability exists in /doorgets/app/views/ajax/commentView.php in doorGets 7.0. A remote, unauthorized attacker can exploit this vulnerability to obtain sensitive database information...
User are receiving mobile notifications of restricted Jira comments that they cannot view when accessing Jira through a browser
Hi Jira Server mobile app beta users, We recently discovered a bug where Jira Server mobile app users receive all comment notifications from Jira issues they’re watching or assigned to, even if the comment had been restricted to exclude them. This means they’ll be able to view the content of...
xss vulnerability in frontend comment manager of fishleap CMS
Fish CMS is a content management system developed by the official Catfish CMS specifically for enterprise applications. An XSS vulnerability exists in the front-end comment management system of FishCenter CMS, which can be exploited by an attacker to obtain an administrator cookie...
CVE-2018-18845
internal/advancedcommentsystem/index.php and internal/advancedcommentsystem/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACSpath. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTM...
CVE-2018-18845
internal/advancedcommentsystem/index.php and internal/advancedcommentsystem/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACSpath. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTM...
Cross site scripting
internal/advancedcommentsystem/index.php and internal/advancedcommentsystem/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACSpath. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTM...
ghostscript security and bug fix update
9.07-31.el76.10 - Resolves: 1673915 - ghostscript: Regression: double comment chars '%' in gsinit.ps leading to missing metadata - Resolves: 1678171 - CVE-2019-3835 ghostscript: superexec operator is available 700585 - Resolves: 1680025 - CVE-2019-3838 ghostscript: forceput in DefineResource is...
CVE-2018-18845
Summary of CVE-2018-18845 (Advanced Comment System): The affected product is Advanced Comment System, version 1.0. The vulnerability is a reflected cross-site scripting (XSS) flaw in internal/advanced_comment_system/index.php and internal/advanced_comment_system/admin.php via ACS_path. A remote, ...
WordPress 5.1: from CSRF to RCE-vulnerability warning-the black bar safety net
One, Foreword Note: this exploit and the environment is more complex, the actual value may not be very high, but forXSSwith permissions management also has certain reference value. Last month we published a WordPress 5.0, a remote code execution RCE）vulnerabilities required by the authentication...
Cross-Site Request Forgery (CSRF)
wordpress is vulnerable to cross-site request forgery CSRF. The vulnerability exists as it does not have any CSRF protections in place to prevent forged request when posting comments. Moreover, a lack of comment content filtering when an administrative user posts a comment, allows a remote attack...
DEBIAN-CVE-2019-9787
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...
Design/Logic Flaw
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...
New WordPress Flaw Lets Unauthenticated Remote Attackers Hack Sites
If for some reason your WordPress-based website has not yet been automatically updated to the latest version 5.1.1, it's highly recommended to immediately upgrade it before hackers could take advantage of a newly disclosed vulnerability to hack your website. Simon Scannell, a researcher at RIPS...