35 matches found
CVE-2025-65031 Rallly Improper Authorization in Comment Endpoint Allows User Impersonation
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization flaw in the comment creation endpoint allows authenticated users to impersonate any other user by altering the authorName field in the API request. This enables attackers to post comments...
CVE-2025-65031 Rallly Improper Authorization in Comment Endpoint Allows User Impersonation
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization flaw in the comment creation endpoint allows authenticated users to impersonate any other user by altering the authorName field in the API request. This enables attackers to post comments...
CVE-2025-65031 Rallly Improper Authorization in Comment Endpoint Allows User Impersonation
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization flaw in the comment creation endpoint allows authenticated users to impersonate any other user by altering the authorName field in the API request. This enables attackers to post comments...
CVE-2025-65031
CVE-2025-65031 affects Rallly versions prior to 4.5.4. A flaw in the comment creation endpoint allows an authenticated user to impersonate arbitrary users by altering the authorName field in the API request, potentially attributing comments to administrators or other privileged accounts and enabl...
PT-2025-47508
Name of the Vulnerable Software and Affected Versions Rallly versions prior to 4.5.4 Description Rallly, an open-source scheduling and collaboration tool, contains a flaw in authorization related to comment creation. An authenticated user can impersonate any other user by modifying the authorName...
PT-2025-41256
Name of the Vulnerable Software and Affected Versions Novel-Plus version 5.2.0 Description An authenticated user can inject malicious JavaScript through the replyContent parameter when replying to a book comment via the /book/addCommentReply endpoint. The malicious payload is stored in the databa...
EUVD-2025-29651
Malicious code in bioql PyPI...
PT-2025-40299
Name of the Vulnerable Software and Affected Versions Jeecgboot versions 3.8.2 and earlier Description Jeecgboot versions 3.8.2 and earlier are susceptible to a path traversal issue. The /sys/comment/addFile API endpoint allows attackers to upload files with system-whitelisted extensions to the...
CVE-2025-56264
The /api/comment endpoint in zhangyd-c OneBlog 2.3.9 contains a denial-of-service vulnerability...
CVE-2025-56264
The /api/comment endpoint in zhangyd-c OneBlog 2.3.9 contains a denial-of-service vulnerability...
OneBlog 安全漏洞
OneBlog is a beautiful and powerful Java blog by yadong.zhang individual developer. A security vulnerability exists in OneBlog version 2.3.9, which stems from a flaw in the /api/comment endpoint that could lead to a denial-of-service attack...
CVE-2025-56264
CVE-2025-56264 affects zhangyd-c OneBlog 2.3.9 with a denial-of-service vulnerability in the /api/comment endpoint. The provided metrics indicate a network-exposed attack surface (AV:N/AC:L/PR:N/UI:N/S:U) with issue causing availability impact (I: N, A: H) and a base CVSSv3.1 score of 7.5. Connec...
PT-2025-38071
Name of the Vulnerable Software and Affected Versions: zhangyd-c OneBlog version 2.3.9 Description: The /api/comment endpoint in zhangyd-c OneBlog is susceptible to a denial-of-service issue. Recommendations: At the moment, there is no information about a newer version that contains a fix for thi...
PT-2024-36058 · Directus · Directus
Name of the Vulnerable Software and Affected Versions: Directus versions prior to 10.13.4 Directus versions prior to 11.2.0 Description: The Comment feature in Directus has a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the...