GHSA-M9HP-7R99-94H5 Critical security issues in XML encoding in github.com/dexidp/dex

Impact The following vulnerabilities have been disclosed, which impact users leveraging the SAML connector: Signature Validation Bypass CVE-2020-15216: https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7 encoding/xml instabilities: - Element namespace prefix...

GlFusion Cms Access Control Vulnerability

glFusion CMS is a content management and publishing system. glFusion CMS v1.7.9 is vulnerable to an access control error, which can be exploited by attackers via /publichtml/comment.php...

CVE-2021-39918

Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows a user to add comments to a vulnerability which cannot be accessed...

Comment Engine Pro <= 1.0 - Editor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some parameters, allowing high privilege users such as editor and above to perform Stored Cross-Site Scripting attacks...

CVE-2021-36911

Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Comment Engine Pro plugin versions = 1.0, could be exploited by users with Editor or higher role...

CVE-2021-36911

Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Comment Engine Pro plugin versions = 1.0, could be exploited by users with Editor or higher role...

Cross site scripting

Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Comment Engine Pro plugin versions = 1.0, could be exploited by users with Editor or higher role...

CVE-2021-36911

CVE-2021-36911 affects WordPress Comment Engine Pro plugin

CVE-2021-36911 WordPress Comment Engine Pro plugin <= 1.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Comment Engine Pro plugin versions = 1.0, could be exploited by users with Editor or higher role...

CVE-2021-36911: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Comment Engine Pro plugin versions = 1.0, could be exploited by users with Editor or higher role...

WordPress cross-site scripting vulnerabilities

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin that stems from a stored cross-site...

PT-2021-21403

Name of the Vulnerable Software and Affected Versions WordPress Comment Engine Pro plugin versions = 1.0 Description A Stored Cross-Site Scripting XSS issue was found in the WordPress Comment Engine Pro plugin. This could be exploited by users with an Editor or higher role. Recommendations For...

Stars Rating < 3.5.1 - Comments Denial of Service

The plugin does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the comments section, or pending comment dashboard depending if the user sent it as unauthenticated or authenticated. Enable rating for a post/page, add a comment, capture the...

PT-2021-6388

Name of the Vulnerable Software and Affected Versions Microsoft Office Visio affected versions not specified Description The issue is related to errors in handling EMR COMMENT EMFPLUS records in EMF files, which can lead to untrusted pointer dereference. This can allow an attacker to execute...

php:php-fuzz-exif: Heap-buffer-overflow in _estrdup

Detailed Report: https://oss-fuzz.com/testcase?key=4702980327211008 Project: php Fuzzing Engine: afl Fuzz Target: php-fuzz-exif Job Type: aflasanphp Platform Id: linux Crash Type: Heap-buffer-overflow READ 15 Crash Address: 0x6040000478f8 Crash State: estrdup exifprocessusercomment...

CVE-2021-38377

OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results...

PT-2021-22091

Name of the Vulnerable Software and Affected Versions OX App Suite versions 7.10.5 and earlier Description The issue allows for XSS via JavaScript code in an anchor HTML comment within truncated e-mail. This is possible because there is a predictable UUID with HTML transformation results...

OX App Suite 7.10.5 Cross Site Scripting / Information Disclosure Vulnerability

OX App Suite versions 7.10.5 and below suffer from cross site scripting and information disclosure vulnerabilities. Product: OX App Suite Vendor: OX Software GmbH Internal reference: OXUIB-872 Vulnerability type: Cross-Site Scripting CWE-80 Vulnerable version: 7.10.5 and earlier Vulnerable...

All Vulnerabilities for nhvrinweb.sos.nh.gov Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| nhvrinweb.sos.nh.gov ---|--- Open Bug...

Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk

Description Stored XSS via Markdown at Description or Comment of Ticket Detail When rendering to Markdown, the application does not filter and check the properties are valid, so when the user enters XSS it will render as XSS . Proof of Concept // PoC.req POST /tickets/submit/ HTTP/1.1 Host:...