5716 matches found
CVE-2020-14189
The vulnerability (CVE-2020-14189) affects Atlassian gajira-comment GitHub Action prior to version 2.0.2, where the execute function in the action can be triggered by a specially crafted GitHub issue comment to execute arbitrary code in the GitHub runner context. Root cause: insecure execution in...
CVE-2020-14189: Undefined Security Weakness
The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue comment...
PT-2020-13921
Name of the Vulnerable Software and Affected Versions Atlassian gajira-comment GitHub Action versions prior to 2.0.2 Description The issue allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue comment. This is due to a...
DEBIAN-CVE-2020-28036
wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post...
BaserCMS Cross-Site Scripting Vulnerability (CNVD-2020-60477)
BaserCMS is an open source enterprise-level content management system cms. A cross-site scripting vulnerability exists in versions of baserCMS prior to 4.4.1. An attacker can exploit this vulnerability by entering a specially crafted nickname in a blog comment to execute arbitrary JavaScript...
CVE-2020-28036
wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post...
Blog comment posting, Cross Site Scripting(XSS) Vulnerability in Latest Release 4.4.0
baserCMS 4.4.0 and earlier is affected by Cross Site Scripting XSS. Impact: XSS via Arbitrary script execution. Components are: Blog comment posting Tested baserCMS Version : 4.4.0 Latest Affected baserCMS Version : 4.0.0 4.4.0 Patches : https://basercms.net/security/20201029 Found by yama...
GHSA-FW5Q-J9P4-3VXG Blog comment posting, Cross Site Scripting(XSS) Vulnerability in Latest Release 4.4.0
baserCMS 4.4.0 and earlier is affected by Cross Site Scripting XSS. Impact: XSS via Arbitrary script execution. Components are: Blog comment posting Tested baserCMS Version : 4.4.0 Latest Affected baserCMS Version : 4.0.0 4.4.0 Patches : https://basercms.net/security/20201029 Found by yama...
PT-2020-14333
Name of the Vulnerable Software and Affected Versions baserCMS versions 4.0.0 through 4.4.0 Description The issue affects the blog comment component, allowing arbitrary JavaScript execution by entering a crafted nickname in blog comments. This can lead to Cross-Site Scripting XSS via arbitrary...
CVE-2020-15276: Improper Neutralization of Input During Web Page Generation
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1...
Withdrawn: HTTP Request Smuggling in Agoo
Withdrawn reason Withdrawn on 1/13/2021 due to this comment from the maintainer. This is no longer considered a vulnerability. Original description agoo through 2.12.3 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. It is possible to...
WordPress Comment Press premium plugin <= 2.7.0 - Unauthenticated Cross-Frame Scripting (XSS) vulnerability
Unauthenticated Cross-Frame Scripting XSS vulnerability found by Ex.Mi in WordPress Comment Press premium plugin versions = 2.7.0. Solution Update the WordPress Comment Press premium plugin to the latest available version at least 2.7.2...
Comment Press < 2.7.2 - Unauthenticated Cross-Frame Scripting
An Unauthenticated Cross-Frame Scripting vulnerability was discovered in the Comment Press plugin v2.7.0 for WordPress. PoC ! :: PoC Burp Suite: POST /wp-comments-post.php HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest...
Comment Press < 2.7.2 - Unauthenticated Cross-Frame Scripting
An Unauthenticated Cross-Frame Scripting vulnerability was discovered in the Comment Press plugin v2.7.0 for WordPress. ! :: PoC Burp Suite: POST /wp-comments-post.php HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest...
Automattic: Able to comment/view in others support ticket at https://en.instagram-brand.com/requests/dashboard
Summary: I reported the vulnerability to Facebook, and they have said to report it here for the bounty. Platforms Affected: https://en.instagram-brand.com/requests/dashboard Steps To Reproduce: 1. Create two account User A, User B at https://en.instagram-brand.com/ 2. Apply for Instagram brand fr...
Design/Logic Flaw
An issue was discovered in Secudos Qiata FTA 1.70.19. The comment feature allows persistent XSS that is executed when reading transfer comments or the global notice board...
CVE-2020-14294
An issue was discovered in Secudos Qiata FTA 1.70.19. The comment feature allows persistent XSS that is executed when reading transfer comments or the global notice board...
CVE-2020-14294: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Secudos Qiata FTA 1.70.19. The comment feature allows persistent XSS that is executed when reading transfer comments or the global notice board...
PT-2020-13961
Name of the Vulnerable Software and Affected Versions Secudos Qiata FTA version 1.70.19 Description An issue was discovered that allows persistent XSS, which is executed when reading transfer comments or the global notice board, due to a flaw in the comment feature. Recommendations For Secudos...
