CVE-2020-11055 Cross-site Scripting in BookStack

In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the...

CVE-2020-11055

In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the...

CVE-2020-11055

BookStack versions >= 0.18.0 and

CVE-2020-12718: Improper Neutralization of Input During Web Page Generation

In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as ontoggle...

PT-2020-12516

Name of the Vulnerable Software and Affected Versions BookStack versions 0.18.0 through 0.29.1 Description The issue allows a user with permission to create comments to inject custom JavaScript code, which could be executed on other users' machines. This is particularly impactful in scenarios whe...

PT-2020-13226

Name of the Vulnerable Software and Affected Versions PHP-Fusion version 9.03.50 Description The issue concerns a stored XSS vulnerability in the Preview Comment feature of the administration/comments.php file. An authenticated attacker can exploit this by bypassing the protection mechanism using...

CVE-2020-11055: Improper Neutralization of Input During Web Page Generation

In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the...

CVE-2020-8775

Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting XSS vulnerability in the comment tags...

CVE-2020-8775

Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting XSS vulnerability in the comment tags...

CVE-2020-8775

Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting XSS vulnerability in the comment tags...

CVE-2020-8775

Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting XSS vulnerability in the comment tags...

PT-2020-20267

Name of the Vulnerable Software and Affected Versions Pega Platform versions prior to 8.2.6 Description The issue is related to a Stored Cross-Site Scripting XSS vulnerability in the comment tags. Recommendations For versions prior to 8.2.6, update to version 8.2.6 or later to resolve the issue...

CVE-2020-8775: Improper Neutralization of Input During Web Page Generation

Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting XSS vulnerability in the comment tags...

php: Heap buffer over-read in exif_process_user_comment()

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exifreaddata function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information...

WordPress WP GDPR plugin <= 2.1.1 - Unauthenticated Arbitrary Comment Deletion vulnerability

Unauthenticated Arbitrary Comment Deletion vulnerability discovered by NinTechNet in WordPress WP GDPR plugin versions = 2.1.1. Solution This plugin has been closed as of October 23, 2019 and is not available for download. Reason: Security Issue...

apostrophe-tumblr (>=0.5.1, <=0.5.13), http-teapot-comment (0.1.0) +1 more potentially affected by CVE-2016-1000237 via sanitize-html (>=1.1.4, <=1.4.2)

sanitize-html NPM version =1.1.4, =0.5.1, =0.5.13 - http-teapot-comment 0.1.0 - piedpiper-middle-out 5.8.1 Source cves: CVE-2016-1000237 Source advisory: OSV:GHSA-3J7M-HMH3-9JMP...

CVE-2019-19500

Matrix42 Workspace Management 9.1.2.2765 and below allows stored XSS via unfiltered description parameters, as demonstrated by the comment field of a special order for individual software...

CVE-2019-19500

CVE-2019-19500 affects Matrix42 Workspace Management 9.1.2.2765 and earlier. The vulnerability is a stored XSS in unfiltered description parameters of the WEB application (e.g., the comment field of a special software order). Root cause: lack of proper validation of client‑side data by the applic...

PT-2020-10172

Name of the Vulnerable Software and Affected Versions Matrix42 Workspace Management versions 9.1.2.2765 and below Description The issue allows stored XSS via unfiltered description parameters, as demonstrated by the comment field of a special order for individual software. This can be exploited...

CVE-2019-19500: Improper Neutralization of Input During Web Page Generation

Matrix42 Workspace Management 9.1.2.2765 and below allows stored XSS via unfiltered description parameters, as demonstrated by the comment field of a special order for individual software...