CVE-2009-5026

The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave is running a newer version than the master, allows remote attackers to execute arbitrary SQL commands via custom comments...

CVE-2012-2082

Cross-site scripting XSS vulnerability in the Chaos tool suite aka CTools module 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with the post comments permission to inject arbitrary web script or HTML via a user signature...

Cross site scripting

Cross-site scripting XSS vulnerability in the Chaos tool suite aka CTools module 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with the post comments permission to inject arbitrary web script or HTML via a user signature...

PT-2012-1273

Name of the Vulnerable Software and Affected Versions MySQL versions 5.0.x through 5.0.92 MySQL versions 5.1.x through 5.1.49 Description The issue allows remote attackers to execute arbitrary SQL commands via custom comments in certain slave configurations where the slave is running a newer...

PT-2012-5294

Name of the Vulnerable Software and Affected Versions Proman Xpress version 5.0.1 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the cl comments parameter in the client details.php file. Recommendations F...

Authentication flaw

The 1 reports API and 2 administration feature in the comments API in the Ushahidi Platform before 2.5 do not require authentication, which allows remote attackers to generate reports and organize comments via API functions...

Information disclosure

The comments API in application/libraries/api/MYCommentsApiObject.php in the Ushahidi Platform before 2.5 allows remote attackers to obtain sensitive information about the e-mail address, IP address, and other attributes of the author of a comment via an API function call...

CVE-2012-3473

The 1 reports API and 2 administration feature in the comments API in the Ushahidi Platform before 2.5 do not require authentication, which allows remote attackers to generate reports and organize comments via API functions...

CVE-2012-3474

The comments API in application/libraries/api/MYCommentsApiObject.php in the Ushahidi Platform before 2.5 allows remote attackers to obtain sensitive information about the e-mail address, IP address, and other attributes of the author of a comment via an API function call...

CVE-2012-3473

The CVE concerns Ushahidi Platform prior to version 2.5 where the (1) reports API and (2) the admin feature of the comments API do not require authentication, allowing unauthenticated remote manipulation via API functions (generate reports and organize comments). Root cause: endpoints expose thes...

CVE-2012-3473: Improper Authentication

The 1 reports API and 2 administration feature in the comments API in the Ushahidi Platform before 2.5 do not require authentication, which allows remote attackers to generate reports and organize comments via API functions...

CVE-2012-3474: Exposure of Sensitive Information to an Unauthorized Actor

The comments API in application/libraries/api/MYCommentsApiObject.php in the Ushahidi Platform before 2.5 allows remote attackers to obtain sensitive information about the e-mail address, IP address, and other attributes of the author of a comment via an API function call...

PT-2012-4743

Name of the Vulnerable Software and Affected Versions Ushahidi Platform versions prior to 2.5 Description The issue allows remote attackers to obtain sensitive information about the e-mail address, IP address, and other attributes of the author of a comment via an API function call in the comment...

PT-2012-4742

Name of the Vulnerable Software and Affected Versions Ushahidi Platform versions prior to 2.5 Description The issue concerns the Ushahidi Platform, where the reports API and administration feature in the comments API do not require authentication. This allows remote attackers to generate reports...

CVE-2012-4071: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the comments module in the RSGallery2 comrsgallery2 component before 2.3.0 for Joomla! 1.5.x, and before 3.2.0 for Joomla! 2.5.x, allows remote attackers to inject arbitrary web script or HTML via crafted BBCode markup in a comment...

PT-2012-5186

Name of the Vulnerable Software and Affected Versions RSGallery2 com rsgallery2 component versions prior to 2.3.0 for Joomla! 1.5.x RSGallery2 com rsgallery2 component versions prior to 3.2.0 for Joomla! 2.5.x Description A cross-site scripting XSS issue exists in the comments module, allowing...

Persistent xss flaw in the revision history (of comments).

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-47387. panel Whilst a comment is html encoded /sanitized when displayed within an answer to a question the revision history page...

iauto mobile Application 2012 - Multiple Vulnerabilities

Title: ====== iAuto Mobile Application 2012 - Multiple Web Vulnerabilities Date: ===== 2012-07-11 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=658 VL-ID: ===== 658 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: ===========...

Worksforweb iAuto - Multiple Cross-Site Scripting HTML Injection Vulnerabilities

Worksforweb iAuto - Multiple Cross-Site Scripting HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/54812/info Worksforweb iAuto is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Successfu...

Worksforweb iAuto - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/54812/info Worksforweb iAuto is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the contex...