CVE-2016-7570

Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes...

CVE-2016-7570

Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes...

CVE-2016-7570: Undefined Security Weakness

Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes...

PT-2016-7389

Name of the Vulnerable Software and Affected Versions Drupal versions 8.x before 8.1.10 Description The issue allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes, due to improper checking for Administer comments...

Cross-site Scripting Vulnerability in EaseUS Content Management System

EECO Content Management System is a marketing enterprise website system developed based on SEO-friendliness. There is an XSS cross-site scripting vulnerability in EE Content Management System. The vulnerability file is comment.php, due to the safecheck function is not filtered completely, the...

Mozilla Wants to Drop WoSign as Trusted CA

Mozilla has accused a Chinese Certificate Authority of back-dating SHA-1 certificates to get around restrictions barring deprecated certs from being trusted, and is ready to ban the CA for one year. The back-dating is just one of many violations derived after a lengthy investigation of WoSign and...

Pornhub: Stored XSS in photo comment functionality

The photo comment functionality is vulnerable to stored cross site scripting: an attacker can craft a comment that contains malicious code and get it stored. This can be reproduced on my test account at http://www.pornhub.com/photo/166952961. Interestingly, differently from 171901 where i could...

Users without "Administer comments" can set comment visibility on nodes they can edit

More info at https://www.drupal.org/SA-CORE-2016-004...

Users without "Administer comments" can set comment visibility on nodes they can edit

More info at https://www.drupal.org/SA-CORE-2016-004...

Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2016-004

Users without "Administer comments" can set comment visibility on nodes they can edit. Less critical Users who have rights to edit a node, can set the visibility on comments for that node. This should be restricted to those who have the administer comments permission. Cross-site Scripting in http...

Nextcloud: Reflected Self-XSS Vulnerability in the Comment section of Files (Different-payloads)

Note::steps mentioned in report164027 In the Comments Box,the payload to execute XSS is passed. Test Payloads: alert1 Also the above payload is still working.. Also try this payload " fooalert1 Click edit comment after posted. XSS Triggers...

Nextcloud: Reflected Self-XSS Vulnerability in the Comment section of Files Information

Vulnerability Found In the test domain: demo.nextcloud.com Vulnerability Type : Reflected XSS STEPS TO REPRODUCE: STEP 1: Login to demo nextcloud server site using test credentials.demo.nextcloud.com STEP 2: On the All Files Tab ,Select Any File. STEP 3: A tab opens on the Right Hand side of the...

Cross site scripting

Cross-site scripting XSS vulnerability in PHPVibe before 4.21 allows remote authenticated users to inject arbitrary web script or HTML via a comment...

CVE-2015-5399

Cross-site scripting XSS vulnerability in PHPVibe before 4.21 allows remote authenticated users to inject arbitrary web script or HTML via a comment...

CVE-2015-5399

Cross-site scripting XSS vulnerability in PHPVibe before 4.21 allows remote authenticated users to inject arbitrary web script or HTML via a comment...

PT-2016-3687

Name of the Vulnerable Software and Affected Versions PHPVibe versions prior to 4.21 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via a comment. Recommendations For versions prior to 4.21, update to version 4.21 or later to...

CVE-2015-5399: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in PHPVibe before 4.21 allows remote authenticated users to inject arbitrary web script or HTML via a comment...

OLX: full path disclosure vulnerability at https://security.olx.com/*

in form of html comment it disclosing full path of file name Security.html in all https://security.olx.com/ links...

Dahan jcms /jcms/jcms_files/jcms1/web1/site/module/comment/opr_ballot. jsp parameters c_uuid time blind

No description provided by source...

JSON export doesn't differentiate public from internal comments

h4. +Summary+ Currently, when exporting a SD request to JSON format, it's not possible to tell which comment is internal or public from the JSON file. h4. +Steps to reproduce+ Go to Manage add-ons - All add-ons - jira-importers-plugin - Enable JSON export Create an SD request and add one internal...