CVE-2018-20153

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS...

CVE-2018-20153

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS...

CVE-2018-20153

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS...

Jiangsu Fargo Streaming Publishing Platform has xss vulnerability

Streaming Media Distribution Platform is a powerful and specialized streaming media distribution system suitable for long-time uninterrupted work, based on years of experience in streaming media R&D and telecom industry services. Streaming Media Distribution Platform has an xss vulnerability in t...

WordPress <= 5.0 - Authenticated Cross-Site Scripting (XSS)

Description According to WordPress: "Tim Coen discovered that contributors could edit new comments from higher-privileged users, potentially leading to a cross-site scripting vulnerability."...

X (Formerly Twitter): Opportunity to post hidden comments

Twitter allows to comment on anyone's tweet. While testing this feature, observed that one can post comment on tweet which will be invisible to the victim whom the reply was posted and would be visible to any other twitter user. This can allow an Attacker to abuse victim on a tweet. The catch her...

WordPress: CSRF to HTML Injection in Comments

Simon discovered a CSRF vulnerability that led to RCE. More details are available on the RIPS blog...

Remote code execution

Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini C1, FRENIC-Mini C2, FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace. The program does not properly check user-supplied comments which may allow for arbitrary remote code execution...

Buffer Overflow Vulnerability in Multiple Fuji Electric Products

Fuji Electric FRENIC Loader, etc. are inverters from Fuji Electric Japan. A stack buffer overflow vulnerability exists in multiple Fuji Electric products, which stems from the program failing to properly detect user-submitted comments. A remote attacker could exploit the vulnerability to execute...

Jspxcms Comments Feature Has XSS Vulnerability

Jspxcms is an open source, Java-based content management system CMS. An XSS vulnerability exists in the comments feature of Jspxcms version 9.0.0, which stems from the failure to encode user-submitted parameters as html entities and to escape special characters, which can be exploited by an...

The Offensive Web Application Penetration Testing Framework: TIDoS

TIDoS Framework is a comprehensive web-app audit framework. TIDoS is made to be comprehensive and versatile. It is a highly flexible framework where you just have to select and use modules. But before that, you need to set your own API KEYS for various OSINT purposes. To do so, open up APIKEYS.py...

CVE-2014-6046

Multiple cross-site request forgery CSRF vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that 1 delete active users by leveraging improper validation of CSRF tokens or that 2 delete open questions, 3 activate users, 4...

CVE-2014-6046

Multiple cross-site request forgery CSRF vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that 1 delete active users by leveraging improper validation of CSRF tokens or that 2 delete open questions, 3 activate users, 4...

Official Cardi B website plagued by spammers

We come bearing tidings of proper website maintenance and general housekeeping for singer Cardi B or rather, for her web development team. At first glance, it appeared as though her website had been hacked a few days ago. But a look under the hood told a different story. We were surprised to see...

Stored XSS in autocomplete suggestions for file comments (NC-SA-2018-008)

A missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users...

[SECURITY] Fedora 27 Update: exiv2-0.26-12.fc27

A command line utility to access image metadata, allowing one to: print the Exif metadata of Jpeg images as summary info, interpreted value s, or the plain data for each tag print the Iptc metadata of Jpeg images print the Jpeg comment of Jpeg images set, add and delete Exif and Iptc metadata of...

CVE-2018-15129

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter...

[SECURITY] Fedora 28 Update: exiv2-0.26-12.fc28

A command line utility to access image metadata, allowing one to: print the Exif metadata of Jpeg images as summary info, interpreted value s, or the plain data for each tag print the Iptc metadata of Jpeg images print the Jpeg comment of Jpeg images set, add and delete Exif and Iptc metadata of...

Foxit Reader Remote Code Execution Vulnerability (CNVD-2018-14565)

Foxit Reader for Windows is China's Foxit Foxit Software Corporation, a Windows-based platform for PDF document reader. A post-release reuse vulnerability exists in the handling of Line comments in Foxit Reader 9.1.0.5096 and earlier versions for Windows. A remote attacker can exploit this...

Foxit Reader Remote Code Execution Vulnerability (CNVD-2018-14453)

Foxit Reader old name: Foxit PDF Reader is a set of software used to read PDF format files, by Fujian Foxit Software developed by Foxit Reader is a set of free to use the software, the operating system is mainly based on Microsoft Windows, and as long as there is a Win32 implementation of the...