WordPress plugin Heateor Social Comments 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-23670

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Team Heateor Fancy Comments WordPress plugin = 1.2.10 versions...

CVE-2023-23670

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Team Heateor Fancy Comments WordPress plugin = 1.2.10 versions...

CVE-2023-23670 WordPress Fancy Comments WordPress Plugin <= 1.2.10 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Team Heateor Fancy Comments WordPress plugin = 1.2.10 versions...

CVE-2023-23670 WordPress Fancy Comments WordPress Plugin <= 1.2.10 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Team Heateor Fancy Comments WordPress plugin = 1.2.10 versions...

CVE-2023-23670

CVE-2023-23670 corresponds to an Authenticated Cross-Site Scripting (XSS) vulnerability in the Team Heateor Fancy Comments WordPress plugin (versions

WordPress plugin Fancy Comments 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Invoke-PSObfuscation - An In-Depth Approach To Obfuscating The Individual Components Of A PowerShell Payload Whether You'Re On Windows Or Kali Linux

Traditional obfuscation techniques tend to add layers to encapsulate standing code, such as base64 or compression. These payloads do continue to have a varied degree of success, but they have become trivial to extract the intended payload and some launchers get detected often, which essentially...

SUSE CVE-2023-28154

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object...

WordPress Lazy Social Comments Plugin <= 2.0.4 is vulnerable to Cross Site Scripting (XSS)

Software Lazy Social Comments Type Plugin Vulnerable versions = 2.0.4 Fixed in 2.0.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23733 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 809f9989685a Credits yuyudhn Required...

Lazy Social Comments <= 2.0.4 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-1250

Improper Input Validation vulnerability in OTRS AG OTRS ACL modules, OTRS AG OTRS Community Edition ACL modules allows Local Execution of Code. When creating/importing an ACL it was possible to inject code that gets executed via manipulated comments and ACL-names This issue affects OTRS: from 7.0...

CVE-2023-1250 Code execution through ACL creation

Improper Input Validation vulnerability in OTRS AG OTRS ACL modules, OTRS AG OTRS Community Edition ACL modules allows Local Execution of Code. When creating/importing an ACL it was possible to inject code that gets executed via manipulated comments and ACL-names This issue affects OTRS: from 7.0...

Typecho 跨站脚本漏洞

typecho is a PHP blogging platform for typecho individual developers. It is simple and powerful. A security vulnerability exists in Typecho version v.1.2.0. An attacker can exploit this vulnerability to execute arbitrary code via the Comment Manager /admin/manage-comments.php component...

Atlassian Jira < 7.13.12 Comment Permissions Broken Access Control

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to version 7.13.12, 8.0.0 prior to 8.5.4 or 8.6.0 prior to 8.6.1. It is, therefore, affected by a vulnerability which permits remote attackers to make comments on a ticket to whi...

DEBIAN-CVE-2023-28154

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object...

UBUNTU-CVE-2023-28154

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object...

PT-2023-21600 · Webpack +3 · Webpack +3

Name of the Vulnerable Software and Affected Versions: Webpack versions prior to 5.76.0 Description: The issue concerns cross-realm object access. Specifically, the ImportParserPlugin.js mishandles the magic comment feature, allowing an attacker who controls a property of an untrusted object to...

Atlassian Confluence 4.3.x < 6.2.1 Access Restriction Bypass using watch notifications

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to version 6.2.1. It is, therefore, affected by access restriction bypass using watch notifications which may permit an attacker to receive workbox notifications containing the...

closeTrove never nulls trove.stake

Lines of code Vulnerability details // Auditor's note: not 100% sure if this is intentional, but I have reason to believe it's a mistake. Description When a trove gets liquidated, its stake gets set to 0 through removeStake, called eg here. However, when a trove gets closed gratiously through...