4024 matches found
Concrete5 Comments on Enumeration Vulnerability
concrete5 is an open source content management system CMS for publishing content on the World Wide Web and intranet. A comment enumeration vulnerability exists in tools/conversations/viewajax.php in Concrete5 before 8.3.0. An unauthenticated user can exploit this vulnerability by posting a reques...
CVE-2017-18195
An issue was discovered in tools/conversations/viewajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/viewajax with incremental 'cnvID' integers...
CVE-2017-18195
An issue was discovered in tools/conversations/viewajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/viewajax with incremental 'cnvID' integers...
PHP Scripts Mall Multi Language Olx Clone Script Cross Site Scripting Vulnerability
PHP Scripts Mall Multi Language Olx Clone Script is a set of PHP based scripts for multilingual information publishing websites from PHP Scripts Mall, India. A cross-site scripting vulnerability exists in PHP Scripts Mall Multi Language Olx Clone Script version 2.0.6. A remote attacker can exploi...
Drupal Information Disclosure Vulnerability (CNVD-2018-05187)
Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security vulnerability exists in Drupal version 8.4.x prior to 8.4.5. An attacker could use the vulnerability to view content and comments that require permissions, and...
FreeBSD : drupal -- Drupal Core - Multiple Vulnerabilities (57580fcc-1a61-11e8-97e0-00e04c1ea73d)
Drupal Security Team reports : CVE-2017-6926: Comment reply form allows access to restricted content CVE-2017-6927: JavaScript cross-site scripting prevention is incomplete CVE-2017-6928: Private file access bypass - Moderately Critical CVE-2017-6929: jQuery vulnerability with untrusted domains -...
DRUPAL-CORE-2018-001
This security advisory fixes multiple vulnerabilities in both Drupal 7 and Drupal 8. See below for a list. Comment reply form allows access to restricted content - Critical - Drupal 8 - CVE-2017-6926 Users with permission to post comments are able to view content and comments they do not have...
drupal -- Drupal Core - Multiple Vulnerabilities
Drupal Security Team reports: CVE-2017-6926: Comment reply form allows access to restricted content CVE-2017-6927: JavaScript cross-site scripting prevention is incomplete CVE-2017-6928: Private file access bypass - Moderately Critical CVE-2017-6929: jQuery vulnerability with untrusted domains -...
Comment reply form allows access to restricted content.
More info at https://www.drupal.org/SA-CORE-2018-001...
Comment reply form allows access to restricted content.
More info at https://www.drupal.org/SA-CORE-2018-001...
CVE-2017-18092
The print snippet resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a comment on the snippet...
CVE-2018-6845
PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field...
CVE-2018-6845
PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field...
Design/Logic Flaw
PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field...
CVE-2018-6845
The CVE-2018-6845 entry concerns PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 and a Cross-Site Scripting (XSS) vulnerability exposed via the Leave Comment field. The CNVD/NVD records confirm a stored/reflected XSS pathway where user-supplied input in comments can inject arbitrary script...
CVE-2018-6845
PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field...
Multi Language Olx Clone Script - Cross-Site Scripting
Exploit Title: Multi Language Olx Clone Script - Stored XSS Date: 08.02.2018 Exploit Author: Varun Bagaria Web: Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/olx-clone/ Category: Web Application Version:2.0.6 Tested on: Windows 7 CVE: NA...
CVE-2017-9513
Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & receive notifications when comments are added to the watched page, and vote & watch JIRA issues that they do not have access to, although th...
Valve: Read Access to all comments on unauthorized forums' discussions! IDOR!
hi, For a forum's discussion, only moderator+ ranks are allowed to view comments which have been deleted by a officer/moderator . I have found an issue where a member who is not allowed to view deleted comments can get read access to the deleted comments on a forum's discussion. Also, a non-membe...