PT-2019-19048

Name of the Vulnerable Software and Affected Versions Jira versions prior to 7.13.6 Jira versions 8.0.0 through 8.3.x Description The issue allows remote attackers who have permission to manage custom fields to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in th...

CVE-2019-8450: Improper Neutralization of Input During Web Page Generation

Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackers who have permission to manage custom fields to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of a custom...

CVE-2017-18611

The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWPCreateCustomFieldPage.php custom-field-css parameter...

PT-2019-8542

Name of the Vulnerable Software and Affected Versions magic-fields plugin versions prior to 1.7.2 Description The issue concerns a cross-site scripting XSS flaw. It is located in the RCCWP CreateCustomFieldPage.php file and is related to the custom-field-css parameter. This parameter is vulnerabl...

CVE-2017-18611: Improper Neutralization of Input During Web Page Generation

The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWPCreateCustomFieldPage.php custom-field-css parameter...

Joomla JS Jobs 1.2.6 Arbitrary File Delete

Exploit Title: Joomla! component comjsjobs 1.2.6 - Arbitrary File Deletion Dork: inurl:"index.php?option=comjsjobs" Date: 2019-08-16 Exploit Author: qw3rTyTy Vendor Homepage: https://www.joomsky.com/ Software Link: https://www.joomsky.com/5/download/1 Version: 1.2.6 Tested on: Debian/nginx/joomla...

HackerOne: Custom Field Attributes may be created and updated for customers with Custom Field Trial enabled

The Custom Field feature is currently only available for customers on the Enterprise product edition. A trial period can be given by enabling the custom-fields-trial feature for programs who are not on that product edition yet. However, when enabling this feature, the incorrect ordering of an ACL...

Multiple Registration - Critical - Access bypass - SA-CONTRIB-2019-048

This module enables you to use special routes for user registration with special roles and custom field sets defined for the role. The module doesn't sufficiently check which user roles can be registered under the scenario when the user tries to register the user with the administrator role. This...

WordPress Custom Field Suite Plugin < 2.5.15 XSS Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

CVE-2019-11871

The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins...

CVE-2019-11871

The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins...

Design/Logic Flaw

The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins...

CVE-2019-11871

The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins...

CVE-2019-11871

The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins...

CVE-2019-11871

The CVE-2019-11871 entry concerns the WordPress plugin Custom Field Suite, affected in versions before 2.5.15. The vulnerability is an authenticated Cross-Site Scripting (XSS) flaw exploitable by editors or admins. The available connected documents confirm the affected component and scope but do ...

PT-2019-12532

Name of the Vulnerable Software and Affected Versions Custom Field Suite plugin versions prior to 2.5.15 Description The issue allows for cross-site scripting XSS attacks, potentially affecting editors or administrators. Recommendations For versions prior to 2.5.15, update to version 2.5.15 or...

CVE-2019-11871: Improper Neutralization of Input During Web Page Generation

The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins...

Custom Field Suite <= 2.5.14 - Authenticated Cross-Site Scripting (XSS)

The Custom Field Suite WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

HackerOne: IDOR in Report CSV export discloses the IDs of Custom Field Attributes of Programs

Specifying a report ID of another team when requesting a CSV export leaks the ID of the Custom Field Attribute in the CSV header. Request POST /reports/export HTTP/1.1 Host: localhost:8080 ... ----------868143055 Content-Disposition: form-data; name="reportids" 17 ----------868143055...

Advanced Custom Fields <= 5.7.7 - Authenticated Cross-Site Scripting (XSS)

According to the vendor: "This release contains a fix to a recently reported XSS vunerability sic. This report showed it was possible for a logged in author to save unfiltered HTML within a custom field value. This is something that should not be possible without the unfilteredhtml capability."...