5538 matches found
PT-2017-7931
Name of the Vulnerable Software and Affected Versions appleple a-blog cms versions 2.6.0.1 and earlier Description The issue is related to a cross-site scripting XSS vulnerability in the standard template of the comment functionality. This allows remote attackers to inject arbitrary web script or...
PT-2017-7930
Name of the Vulnerable Software and Affected Versions appleple a-blog cms versions 2.6.0.1 and earlier Description The issue concerns the session management of the comment functionality, allowing remote attackers to obtain or modify sensitive data. Recommendations For versions 2.6.0.1 and earlier...
Restricted Work Log entries show in the Activity Stream for JIRA Cloud
h3. Summary When using a group comment visibility on worklogs the restriction is not applied in the Activity Stream. h3. Steps to Reproduce Set up a test user JIRA Users. Enable comment visibility to support groups as per Configuring JIRA...
FedRAMP Tailored program for low-risk use cloud service offerings
On February 16, the FedRAMP Project Management Office PMO released the new FedRAMP Tailored security controls baseline for public comment comment period closes March 17, 2017. The new FedRAMP Tailored security controls baseline was created for Cloud Service Providers CSPs who have cloud service...
PHPCMS 'phpcms\modules\member\index.php ' Arbitrary Password Reset Vulnerability
PHPCMS is a website management software. The software adopts modular development and supports a variety of classification methods, using it can easily realize the design, development and maintenance of personalized websites. PHPCMS 'phpcms\modules\member\index.php ' has an arbitrary password rese...
Arbitrary shell execution
Security Advisory This release contains a fix for a security advisory related to the improper handling of shell commands Uses of shellexec and exec were not escaping filenames and configuration settings in most cases A properly crafted filename or configuration option would allow for arbitrary co...
Joomla! Component BookLibrary 3.6.1 - SQL Injection
Joomla! Component BookLibrary 3.6.1 - SQL Injection Exploit Title: Joomla! Component BookLibrary v3.6.1 - SQL Injection Google Dork: inurl:index.php?option=combooklibrary Date: 22.02.2017 Vendor Homepage: http://ordasoft.com/ Software Buy:...
Joomla! Component BookLibrary 3.6.1 - SQL Injection
Exploit Title: Joomla! Component BookLibrary v3.6.1 - SQL Injection Google Dork: inurl:index.php?option=combooklibrary Date: 22.02.2017 Vendor Homepage: http://ordasoft.com/ Software Buy: https://extensions.joomla.org/extensions/extension/living/education-a-culture/booklibrary-basic/ Demo:...
UBUNTU-CVE-2016-4861
The 1 order and 2 group methods in ZendDbSelect in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation...
CVE-2015-8831
Cross-site scripting XSS vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the author name in a comment...
Cross site scripting
Cross-site scripting XSS vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the author name in a comment...
Rockstar Games: <- Critical IDOR vulnerability in socialclub allow to insert and delete comments as another user and it discloses sensitive information ->
In this report, the researcher found an insecure direct object reference that allowed a malicious user to impersonate another user in the comment section under Newswire articles. This meant that an attacker could leave abusive comments that appeared to have been made by another user, or delete a...
Serendipity Cross-Site Request Forgery Vulnerability (CNVD-2017-00771)
Serendipity is a PHP-based blogging system developed by Serendipity team. The system supports the creation of online journals, blogs, web pages and more. A cross-site request forgery vulnerability exists in the comment.php page in Serendipity 2.0.5 and earlier versions, which allows attackers to...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to inject arbitrary web script or HTML via a .swf file in a 1 comment frame or 2 avatar frame...
CVE-2017-5494
Multiple cross-site scripting XSS vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to inject arbitrary web script or HTML via a .swf file in a 1 comment frame or 2 avatar frame...
CVE-2017-5494
Multiple cross-site scripting XSS vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to inject arbitrary web script or HTML via a .swf file in a 1 comment frame or 2 avatar frame...
PT-2017-16535
Name of the Vulnerable Software and Affected Versions b2evolution versions prior to 6.8.4 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via a .swf file in a comment frame or avatar frame, potentially leading to cross-site scripting XSS attacks...
CVE-2017-5494: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to inject arbitrary web script or HTML via a .swf file in a 1 comment frame or 2 avatar frame...