XSS Vulnerability at JEESNS Group Comments

JEESNS is an open source social management system developed on JAVA's enterprise-class platform. JEESNS group comments at the existence of XSS vulnerability , an attacker can be exploited to inject arbitrary Web script or HTML...

CVE-2019-11835

cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments...

DEBIAN-CVE-2019-11835

cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments...

AZL-41390 CVE-2019-11835 affecting package libglvnd for versions less than 1.7.0-2

cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments...

CVE-2019-11835

cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments...

Cross site scripting

cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments...

CVE-2019-11835

cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments...

CVE-2019-11835

cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments...

CVE-2019-11835

CVE-2019-11835 affects the cJSON library prior to 1.7.11, where parsing issues with multiline comments enable out-of-bounds access. Impact per sources: high severity (CVSS 3.1 base 9.8; NETWORK, LOW complexity, NONE privileges). Affected: cJSON before 1.7.11. Remediation: upgrade to 1.7.11 or lat...

CVE-2019-11835

cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments...

PT-2019-12518 · Dave Gamble · Cjson

Name of the Vulnerable Software and Affected Versions: cJSON versions prior to 1.7.11 Description: The issue allows out-of-bounds access, related to multiline comments. Recommendations: For versions prior to 1.7.11, update to version 1.7.11 or later to resolve the issue...

GitLab: DoS attack via comment on Issue

Summary There is no limit to the number of characters in the issue comments, which allows a DoS attack. The DoS attack affects both server-side and client-side. NOTE: This bug happens on GitLab.com. Steps to reproduce ▼Attack for Client-side 1. Sign in to GitLab. 2. Create a project as below: -...

FreeBSD : Gitlab -- Multiple vulnerabilities (1138b39e-6abb-11e9-a685-001b217b3468)

Gitlab reports : Moving an Issue to Private Repo Leaks Project Namespace Notification Emails Sent to Restricted Users Unauthorized Comments on Confidential Issues Merge Request Approval Count Inflation Unsanitized Branch Names on New Merge Request Notification Emails Improper Sanitation of...

Gitlab -- Multiple vulnerabilities

Gitlab reports: Moving an Issue to Private Repo Leaks Project Namespace Notification Emails Sent to Restricted Users Unauthorized Comments on Confidential Issues Merge Request Approval Count Inflation Unsanitized Branch Names on New Merge Request Notification Emails Improper Sanitation of...

XSS Vulnerability in FishLeap CMS Frontend Comments List

Fish CMS is a content management system developed by the official Catfish CMS specifically for enterprise applications. An XSS vulnerability exists in the front-end comment list of FishCare CMS, which can be exploited by an attacker to obtain an administrator cookie...

XSS Vulnerability in Fish Leap CMS Frontend at Comments

Fish CMS is a content management system developed by the official Catfish CMS specifically for enterprise applications. An XSS vulnerability exists in the front-end comments of FishCenter CMS, which can be exploited by an attacker to obtain an administrator cookie...

Vanilla: Hidden Stored XSS in nested post embeds

Summary: Comments can be crafted in a way that when quoted will trigger a hidden stored XSS payload. Requires initial user interaction. Description: When quoting a comment, an attacker can edit the insert embed-external data url field to contain a string which when parsed, can result in the...

Vanilla: Stored XSS in Profile Comments

Summary: The Profile Comments page which is responsible for listing a profile's recent comments is vulnerable to stored XSS as it renders the contents of recent comments without sanitizing them. Steps to reproduce: 1. Ensure you are logged in to a user account no special permissions are needed 2...

Jfinal cms xss vulnerability at frontend comments

Jfinal cms uses JFinal as a web framework , template engine with beetl, database with mysql, front-end bootstrap, flat ui and other frameworks. Support for multi-site , oauth2 authentication , account registration , password encryption , comments and replies , message alerts , site visits...

ALPINE-CVE-2018-12550

When Eclipse Mosquitto version 1.0 to 1.5.5 inclusive is configured to use an ACL file, and that ACL file is empty, or contains only comments or blank lines, then Mosquitto will treat this as though no ACL file has been defined and use a default allow policy. The new behaviour is to have an empty...