CVE-2022-23889

The CVE-2022-23889 entry concerns YzmCMS v6.3 where the comment function can be operated concurrently, enabling an attacker to generate an unusually large number of comments. The core issue is a race/concurrency condition in the comment handling code, leading to potential resource exhaustion or i...

CVE-2022-23889

The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments...

CVE-2022-23888

YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey CSRF via the component /yzmcms/comment/index/init.html...

CVE-2022-23888

YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey CSRF via the component /yzmcms/comment/index/init.html...

CVE-2022-23888

YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey CSRF via the component /yzmcms/comment/index/init.html...

PT-2022-16313

Name of the Vulnerable Software and Affected Versions YzmCMS version 6.3 Description A Cross-Site Request Forgery CSRF issue was discovered in the component /yzmcms/comment/index/init.html. Recommendations For YzmCMS version 6.3, consider implementing proper CSRF protection mechanisms, such as...

Yzmcms Cross-Site Request Forgery Vulnerability

Yzmcms is an open source CMS Content Management System for Yzmcms personal developers. YzmCMS v6.3 is vulnerable to cross-site request forgery, which can be exploited by attackers to trigger cross-site request forgery CSRF via the component /yzmcms/comment/index/init.html...

PT-2022-16314

Name of the Vulnerable Software and Affected Versions YzmCMS version 6.3 Description The issue in YzmCMS allows attackers to create an unusually large number of comments due to the concurrent operation of the comment function. Recommendations For YzmCMS version 6.3, consider disabling the comment...

CVE-2022-23889: Uncontrolled Recursion

The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments...

CVE-2022-23888: Cross-Site Request Forgery (CSRF)

YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey CSRF via the component /yzmcms/comment/index/init.html...

WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones either intentionnaly or not and lead to Stored Cross-Site Scripting issues PoC Import the following CSV as comment:...

cve_tracking

cvetracking 介绍 cve 补丁自动获取工具，该工具将会根据 cve 和 rpm 包自动在上游社区查找补丁并反馈结果，同时也可以下载查找到的补丁以及验证补丁的可用性。 软件架构 python 可执行代码 安装教程 1. 下载代码 shell git clone https://gitee.com/openeuler/cve-manager.git 2. 进入工具执行目录 shell cd xxx上述代码下载目录/cve-manager/cve-agency-manager/cvetracking 3. 在 cve-tracking.yaml 的 authentication 中...

GROWI vulnerable to authorization bypass through user-controlled key

Overview GROWI provided by WESEEK, Inc. contains an authorization bypass through user-controlled key vulnerability CWE-639, CVE-2021-3852. huntr first reported this vulnerability to JPCERT/CC, then JPCERT/CC contacted WSEEK, Inc. as an intermediator. After the coordination between huntr and WESEE...

Comment reply notifications sent to incorrect users

Impact When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that a user could listen in to new comment replies on pages they have not had editing access t...

GHSA-XQXM-2RPM-3889 Comment reply notifications sent to incorrect users

Impact When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that a user could listen in to new comment replies on pages they have not had editing access t...

android-gif-drawable vulerable to denial of service due to unrestricted comment length

decoding.c in android-gif-drawable before 1.2.24 does not limit the maximum length of a comment, leading to denial of service...

GHSA-3MM4-W7V6-4RHV android-gif-drawable vulerable to denial of service due to unrestricted comment length

decoding.c in android-gif-drawable before 1.2.24 does not limit the maximum length of a comment, leading to denial of service...

CVE-2022-23435

decoding.c in android-gif-drawable before 1.2.24 does not limit the maximum length of a comment, leading to denial of service...

CVE-2022-23435: Undefined Security Weakness

decoding.c in android-gif-drawable before 1.2.24 does not limit the maximum length of a comment, leading to denial of service...

CVE-2022-21683

Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that ...