543 matches found
Advanced Custom Fields <= 5.7.7 - Authenticated Cross-Site Scripting (XSS)
According to the vendor: "This release contains a fix to a recently reported XSS vunerability sic. This report showed it was possible for a logged in author to save unfiltered HTML within a custom field value. This is something that should not be possible without the unfilteredhtml capability."...
DomainMOD cross-site scripting vulnerability (CNVD-2018-26480)
DomainMod is a PHP and MySQL based open source application for managing centrally located domain names and other Internet assets. A cross-site scripting vulnerability exists in the admin/domain-fields/ page in DomainMod 4.11.01 and earlier versions. A remote attacker can exploit this vulnerabilit...
CVE-2018-19750
DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields...
CVE-2018-19750
DomainMOD up to version 4.11.01 contains a stored cross-site scripting (XSS) vulnerability in the admin/domain-fields notes field used when adding a Custom Domain Field. The issue is triggered via input in the notes field of the Add Custom Field action for Custom Domain Fields. The available docu...
CVE-2016-5364
Cross-site scripting XSS vulnerability in managecustomfieldeditpage.php in MantisBT 1.2.19 and earlier allows remote attackers to inject arbitrary web script or HTML via the return parameter...
Debian DLA-512-1 : mantis security update
It was discovered that there was an XSS vulnerability in custom field management in mantis, a web-based bug tracking system. For Debian 7 'Wheezy', this issue has been fixed in mantis version 1.2.18-1+deb7u1. We recommend that you upgrade your mantis packages. NOTE: Tenable Network Security has...
MantisBT cross-site scripting vulnerability (CNVD-2016-03974)
MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. MantisBT has a cross-site scripting vulnerability in the custom field management. Allow attackers to exploit the...
DLA-512-1 mantis - security update
Bulletin has no description...
OpenCart 2.1.0.2 2.2.0.0 - json_decode Function Remote Code Execution
OpenCart 2.1.0.2 2.2.0.0 - jsondecode Function Remote Code Execution OpenCart jsondecode function Remote PHP Code Execution Author: Naser Farhadi Twitter: @naserfarhadi Date: 9 April 2016 Version: 2.1.0.2 to 2.2.0.0 Latest version Vendor Homepage: http://www.opencart.com/ Vulnerability:...
OpenCart 2.1.0.2 < 2.2.0.0 - json_decode Function Remote Code Execution
OpenCart jsondecode function Remote PHP Code Execution Author: Naser Farhadi Twitter: @naserfarhadi Date: 9 April 2016 Version: 2.1.0.2 to 2.2.0.0 Latest version Vendor Homepage: http://www.opencart.com/ Vulnerability: ------------ /upload/system/helper/json.php $match = '/".??!\\"/'; $string =...
OpenCart 2.2.0.0 Remote PHP Code Execution
OpenCart jsondecode function Remote PHP Code Execution Author: Naser Farhadi Twitter: @naserfarhadi Date: 9 April 2016 Version: 2.1.0.2 to 2.2.0.0 Latest version Vendor Homepage: http://www.opencart.com/ Vulnerability: ------------ /upload/system/helper/json.php $match = '/".??!\\"/'; $string =...
User Picker Custom field HTML tags showing when creating new issues
h3. Summary Customer reported that when creating custom field User Picker and added html tags in description field, text link shows correctly in Custom Field screen under Administration Setting. However when creating new issues, the create issue form for User Picker field shows the HTML code not...
User Picker Custom field HTML tags showing when creating new issues
h3. Summary Customer reported that when creating custom field User Picker and added html tags in description field, text link shows correctly in Custom Field screen under Administration Setting. However when creating new issues, the create issue form for User Picker field shows the HTML code not...
WordPress Custom Field Suite Plugin <= 2.4 - Insufficient Authorisation
Because of this vulnerability, attacker can import and export custom fields. Solution Update the plugin...
Custom Field Suite <= 2.4 - Insufficient Authorisation
Any authenticated user is able to import and export Custom Field Suite config via AJAX...
Grant "Browse Project" permission to "User Custom Field Value" makes project visible to all users
panel:bgColor=e7f4fa NOTE: This bug report is for JIRA Server. Using JIRA Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/JRACLOUD-37117. panel If in your permission schema, you grant Browse Project permission to "User Custom Field Value", the project is visible to all...
Grant "Browse Project" permission to "User Custom Field Value" makes project visible to all users
panel:bgColor=e7f4fa NOTE: This bug report is for JIRA Server. Using JIRA Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/JRACLOUD-37117. panel If in your permission schema, you grant Browse Project permission to "User Custom Field Value", the project is visible to all...
Make custom field description and options rendering consistent for OnDemand and BTF
panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Cloud. Using JIRA Server? See the corresponding suggestion|http://jira.atlassian.com/browse/JRASERVER-34440. panel JIRA has different behaviour for how it renders custom field descriptions and options depending on if it's running BTF or on...
Make custom field description and options rendering consistent for OnDemand and BTF
JIRA has different behaviour for how it renders custom field descriptions and options depending on if it's running BTF or on OnDemand. On OnDemand, custom field descriptions are wiki markup, but on BTF they're HTML. On OnDemand, custom field options e.g. for checkbox are plain text, but on BTF...
Make custom field description and options rendering consistent for OnDemand and BTF
panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Server. Using JIRA Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/JRACLOUD-34440. panel JIRA has different behaviour for how it renders custom field descriptions and options depending on if it's running BTF or on...