5668 matches found
CVE-2024-0830: Cross-Site Request Forgery (CSRF)
The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0. This is due to missing or incorrect nonce validation on several ajax actions. This makes it possible for unauthenticated attackers to invoke...
PT-2024-2259
Name of the Vulnerable Software and Affected Versions TOTOLINK X2000R versions prior to V1.0.0-B20231213.1013 Description The issue is related to the lack of protection for the web page structure when handling the Comment input field, allowing a remote attacker to conduct cross-site scripting...
OTRS Request Processing Authentication Bypass
The vulnerability of the OTRS request processing system is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to add additional files to the comments of any user...
CVE-2024-28228
In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible...
CVE-2024-28228
In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible...
CVE-2024-28228
In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible...
JetBrains YouTrack Security Vulnerability
JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A security vulnerability exists in versions prior to JetBrains YouTrack 2024.1.25893, which...
BIT-WORDPRESS-2020-25286
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public...
BIT-WORDPRESS-MULTISITE-2020-25286
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public...
BIT-WORDPRESS-2020-28036
wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post...
BIT-WORDPRESS-MULTISITE-2020-28036
wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post...
BIT-DRUPAL-2020-9281
A cross-site scripting XSS vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment with the ckeprotected syntax...
BIT-DRUPAL-2021-33829
A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...
AZL-98655 CVE-2024-24784 affecting package golang 1.27.1-1
The ParseAddressList function incorrectly handles comments text within parentheses within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers...
CVE-2024-24784: Undefined Security Weakness
The ParseAddressList function incorrectly handles comments text within parentheses within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers...
CVE-2024-25167: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in eblog v1.0 allows a remote attacker to execute arbitrary code via a crafted script to the argument description parameter when submitting a comment on a post...
PT-2024-20795 · Eblog · Eblog
Name of the Vulnerable Software and Affected Versions: eblog version 1.0 Description: The issue allows a remote attacker to execute arbitrary code via a crafted script to the description parameter when submitting a comment on a post. This is a Cross Site Scripting issue. Recommendations: For eblo...
CVE-2024-25167
Cross Site Scripting vulnerability in eblog v1.0 allows a remote attacker to execute arbitrary code via a crafted script to the argument description parameter when submitting a comment on a post...
GHSA-24RP-Q3W6-VC56 org.postgresql:postgresql vulnerable to SQL Injection via line comment generation
Impact SQL injection is possible when using the non-default connection property preferQueryMode=simple in combination with application code that has a vulnerable SQL that negates a parameter value. There is no vulnerability in the driver when using the default query mode. Users that do not overri...