WordPress Comment Attachment Plugin <= 1.0 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "Attachment field title." Solution Update the plugin...

CVE-2013-6010: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Comment Attachment plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "Attachment field title."...

CVE-2013-5690: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange AppSuite before 7.2.2 allow remote authenticated users to inject arbitrary web script or HTML via 1 content with the text/xml MIME type or 2 the Status comment field of an appointment...

ZiMB Comment Joomla! Component <= 0.8.1 Multiple Vulnerabilities - Active Check

ZiMB Comment Joomla! Component is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Wordpress NOSpamPTI Plugin - Blind SQL Injection Vulnerability

Exploit for php platform in category web applications NOSpamPTI Wordpress plugin Blind SQL Injection Vendor product description NOSpamPTI eliminates the spam in your comment box so strong and free, developed from the idea of Nando Vieira http://bit.ly/d38gB8, but some themes do not support change...

PT-2013-5868

Name of the Vulnerable Software and Affected Versions NOSpam PTI plugin version 2.1 for WordPress Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the comment post ID parameter in the wp-comments-post.php file. Recommendations For NOSpam PTI...

WordPress Plugin NOSpamPTI - Blind SQL Injection

NOSpamPTI Wordpress plugin Blind SQL Injection Vendor product description NOSpamPTI eliminates the spam in your comment box so strong and free, developed from the idea of Nando Vieira http://bit.ly/d38gB8, but some themes do not support changes to the functions.php to this we alter this function...

WordPress NOSpamPTI 2.1 Blind SQL Injection Vulnerability

WordPress NOSpamPTI plugin version 2.1 suffers from a remote blind SQL injection vulnerability. NOSpamPTI Wordpress plugin Blind SQL Injection Vendor product description NOSpamPTI eliminates the spam in your comment box so strong and free, developed from the idea of Nando Vieira...

WordPress Comment Attachment 1.0 Cross Site Scripting

Exploit Title: WordPress Comment Attachment 1.0 Discussion Comment Attachment 3 Insert In "Attachment field title" This Code And Save : "alert/Arsan/ 4 And Try To See Your Post And Comment; Follow Link : http://localhost/wp/?p=1 You See Alert "Arsan" ; + Contact Me : [email protected]...

CVE-2013-4298

The ReadGIFImage function in coders/gif.c in ImageMagick before 6.7.8-8 allows remote attackers to cause a denial of service memory corruption and application crash via a crafted comment in a GIF image...

DEBIAN-CVE-2013-4298

The ReadGIFImage function in coders/gif.c in ImageMagick before 6.7.8-8 allows remote attackers to cause a denial of service memory corruption and application crash via a crafted comment in a GIF image...

CVE-2013-4298

The ReadGIFImage function in coders/gif.c in ImageMagick before 6.7.8-8 allows remote attackers to cause a denial of service memory corruption and application crash via a crafted comment in a GIF image...

CVE-2013-4298

The ReadGIFImage function in coders/gif.c in ImageMagick before 6.7.8-8 allows remote attackers to cause a denial of service memory corruption and application crash via a crafted comment in a GIF image...

SA-CONTRIB-2013-068 - Entity API - Access Bypass

The Entity API module extends the entity API of Drupal core in order to provide a unified way to deal with entities and their properties. The module doesn't sufficiently enforce node access restrictions when checking for a user's access to view a comment associated with a particular node. The...

Chinese Hackers Caught by US water control system Honeypots

A notorious Chinese hacker collective known as APT1 or Comment Crew, possibly linked to the Chinese Army, have been caught red handed breaking into a fake United States water control system i.e. known as a Honeypot. Kyle Wilhoit, a researcher with security company Trend Micro has just revealed th...

WordPress Comment Extra Fields 1.7 CSRF / XSS

Description : Wordpress Plugins - Comment Extra Fields XSRF/XSS Injection : http://site/wordpress/wp-content/plugins/comment-extra-field/scripts/swfupload.swf?movieName=";catcheif!self.aself.a=!alert'XSS';//...

Restricted Work Log entries show in the Activity Stream in JIRA Server

h3. Summary When using a group comment visibility on worklogs the restriction is not applied in the Activity Stream. h3. Steps to Reproduce Set up a test user JIRA Users. Enable comment visibility to support groups as per Configuring JIRA...

Restricted Work Log entries show in the Activity Stream in JIRA Server

h3. Summary When using a group comment visibility on worklogs the restriction is not applied in the Activity Stream. h3. Steps to Reproduce Set up a test user JIRA Users. Enable comment visibility to support groups as per Configuring JIRA...

Anchor CMS 0.9.1 - Persistent Cross-Site Scripting

Anchor CMS 0.9.1 - Persistent Cross-Site Scripting Exploit Title : AnchorCMS Stored XSS exploit v0.9.1 Exploit Author: DURAKIBOX / dn5 Website : halisduraki.com Email : [email protected] Date : 18.7.2013. CMS uri : http://anchorcms.com/ Version : AnchorCMS File : article.php file shows article/post...

CVE-2013-2122

The Edit Limit module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict access to comments, which allows remote authenticated users with the "edit comments" permission to edit arbitrary comments of other users via unspecified vectors...