CVE-2017-1000432

Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access...

StivaSoft PHPJabbers File Sharing Script Cross-Site Scripting Vulnerability

StivaSoft PHPJabbers File Sharing Script is a set of online file sharing scripts from the Bulgarian company StivaSoft. A cross-site scripting vulnerability exists in the comments section of StivaSoft PHPJabbers File Sharing Script. A remote attacker can exploit this vulnerability to inject...

CVE-2017-12813

PHPJabbers File Sharing Script 1.0 has stored XSS in the comments section...

CVE-2017-12813

PHPJabbers File Sharing Script 1.0 has stored XSS in the comments section...

Happy 8th Birthday, KrebsOnSecurity!

Eight years ago today I set aside my Washington Post press badge and became an independent here at KrebsOnSecurity.com. What a wild ride it has been. Thank you all, Dear Readers, for sticking with me and for helping to build a terrific community. This past year KrebsOnSecurity published nearly 16...

FreeBSD : libXcursor -- integer overflow that can lead to heap buffer overflow (ddecde18-e33b-11e7-a293-54e1ad3d6335)

The freedesktop.org project reports : It is possible to trigger heap overflows due to an integer overflow while parsing images and a signedness issue while parsing comments. The integer overflow occurs because the chosen limit 0x10000 for dimensions is too large for 32 bit systems, because each...

Syhunt ScanTools 6.0 - Console Web Vulnerability Scan Tools

Syhunt ScanTools 6.0 adds advanced fingerprinting capabilities, enhanced spidering, injection and code scan capabilities, and a large number of improved checks. Adds the display of Hybrid, Dynamic and Code detailed scan statistics to the command-line tools. New fingerprinting capabilities - Becau...

Ed: Oauth flow on the comments widget login can lead to the access code leakage

Description Hello. Here is a keyword: frog I discovered an little Oauth flow in the comments widget authentication process using redirecturi manipulations. The widget located on the all blogposts, which have URL https://edoverflow.com/2017/post-title/ Upon authentication, it appeared that code...

The vulnerability of the FortiOS operating system arises from the lack of measures taken to protect the structure of web pages, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of the FortiOS operating system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks by entering malicious code into the “Comments” field and saving the modified...

Catalyst Mahara Anonymous Comments Vulnerability

Catalyst Mahara is a social networking system from Catalyst IT in New Zealand. The system includes a blog, resume builder, file manager, and more. A security vulnerability exists in Catalyst Mahara versions 1.9 before 1.9.7, 1.10 before 1.10.5, and 15.04 before 15.04.2. An attacker could exploit...

CVE-2017-1000145

Mahara 1.9 before 1.9.7 and 1.10 before 1.10.5 and 15.04 before 15.04.2 are vulnerable to anonymous comments being able to be placed on artefact detail pages even when the site administrator had disallowed anonymous comments...

CVE-2017-1000145

Mahara 1.9 before 1.9.7 and 1.10 before 1.10.5 and 15.04 before 15.04.2 are vulnerable to anonymous comments being able to be placed on artefact detail pages even when the site administrator had disallowed anonymous comments...

CVE-2017-1000145

Mahara up to 1.9.7, 1.10 up to 1.10.5, and 15.04 up to 15.04.2 are vulnerable to anonymous comments on artefact detail pages even when anonymous comments are disallowed. The issue affects the artefact detail page comment handling and is described consistently across multiple sources (CVE-2017-100...

httpd: # character matches all IPs

A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd, causing comments in the "Allow" and "Deny" configuration lines to be parsed incorrectly. A web administrator could unintentionally allow any client to access a restricted HTTP resource...

PT-2017-3746 · Apache +2 · Httpd +2

Name of the Vulnerable Software and Affected Versions: httpd version 2.2.15-60 Description: A regression was found in httpd, causing comments in the "Allow" and "Deny" configuration lines to be parsed incorrectly. This issue is related to the use of memory after it has been freed when processing...

Kallithea < 0.3.2 Multiple Vulnerabilities

Kallithea is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:kallithea:kallithea"; ifdescripti...

Cross site scripting

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via 'Comments' while saving Config Revisions...

Concrete CMS: 'cnvID' parameter vulnerable to Insecure Direct Object References

Installation Information === IIS 8, PHP 5.5, Concrete5 5.7.5.7 Default install Issue POC An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/viewajax with incremental 'cnvID' integers. 1. An example blog with permission...

VK.com: XSS в комментариях от имени сообщества

XSS в дропдауне выбора сообщества при комментировании...

China Enforces Real-Name Policy to Regulate Online Comments

If you reside in China, your Internet life within the borders will soon be even more challenging. Last Friday, China's top Internet regulator announced a new set of rules that would force citizens to post comments using their real-world identities on Internet forums and other web platforms. Yes,...