WordPress Comment Reply Email Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Comment Reply Email Type Plugin Vulnerable versions = 1.0.3 Fixed in 1.0.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-45008 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID fa87fe52845c Credits Yebin Lee Required privilege...

Cross-Site Scripting (XSS)

html/template is vulnerable to Cross-Site Scripting XSS attacks. The vulnerability exists because the package does not properly handle HTML-like "" comment tokens, nor hashbang "!" comment tokens, in...

CVE-2023-44270

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the...

CVE-2023-44270

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the...

PT-2023-28727 · Jfinalcms +1 · Jfinalcms +1

Name of the Vulnerable Software and Affected Versions: SpringbootCMS version 1.0 JFinalCMS affected versions not specified Description: The issue allows malicious code to be embedded in the foreground message and saved in the database. When users browse comments, the embedded malicious code in th...

WordPress Comment Blacklist Updater Plugin <= 1.1.0 is vulnerable to Broken Access Control

Software Comment Blacklist Updater Type Plugin Vulnerable versions = 1.1.0 Fixed in 1.2.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-44147 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 32e14d976eb2 Credits Nguyen Xuan Chien...

GHSA-JCWR-X25H-X5FH codehaus-plexus vulnerable to XML injection

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtilwriteComment fails to sanitize comments for a -- sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.20 (SUSE-SU-2023:3700-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3700-1 advisory. Update to go1.20.8 bsc1206346. - CVE-2023-39318: Fixed improper handling of HTML-like comments...

javaparser:parseFuzzer: Security exception in com.github.javaparser.CommentsInserter.insertComments

Project: https://github.com/javaparser/javaparser.git Detailed Report: https://oss-fuzz.com/testcase?key=6478162038751232 Project: javaparser Fuzzing Engine: libFuzzer Fuzz Target: parseFuzzer Job Type: libfuzzerasanjavaparser Platform Id: linux Crash Type: Security exception Crash Address: Crash...

CVE-2023-5024

A vulnerability was found in Planno 23.04.04. It has been classified as problematic. This affects an unknown part of the component Comment Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may ...

Cross site scripting

A vulnerability was found in Planno 23.04.04. It has been classified as problematic. This affects an unknown part of the component Comment Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may ...

CVE-2023-5024 Planno Comment cross site scripting

A vulnerability was found in Planno 23.04.04. It has been classified as problematic. This affects an unknown part of the component Comment Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may ...

CVE-2023-5024 Planno Comment cross site scripting

A vulnerability was found in Planno 23.04.04. It has been classified as problematic. This affects an unknown part of the component Comment Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may ...

CVE-2023-5024: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Planno 23.04.04. It has been classified as problematic. This affects an unknown part of the component Comment Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may ...

Planno Cross-Site Scripting Vulnerability

Planno is an AI-powered solar development platform from Planno. A cross-site scripting vulnerability exists in Planno version 23.04.04, which stems from a cross-site scripting XSS vulnerability in the component Comment Handler...

PT-2023-31503 · Planno · Planno

Name of the Vulnerable Software and Affected Versions: Planno version 23.04.04 Description: A problematic issue affects an unknown part of the component Comment Handler, leading to cross-site scripting. The manipulation can be initiated remotely. Recommendations: For Planno version 23.04.04, at t...

CVE-2023-39318

A flaw was found in Golang. The html/template package did not properly handle HMTL-like "" comment tokens, nor hashbang "!" comment tokens, in...

CVE-2023-0119

A stored Cross-site scripting vulnerability was found in foreman. The Comment section in the Hosts tab has incorrect filtering of user input data. As a result of the attack, an attacker with an existing account on the system can steal another user's session, make requests on behalf of the user, a...

AZL-37494 CVE-2023-39318 affecting package golang for versions less than 1.21.6-1

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "!" comment tokens, in contexts. This may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS atta...

AZL-78980 CVE-2023-39318 affecting package golang 1.25.7-1

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "!" comment tokens, in contexts. This may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS atta...