CVE-2022-1599

The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status draft, published, slug, post date, comment status enabled,...

Cross site request forgery (csrf)

The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status draft, published, slug, post date, comment status enabled,...

CVE-2022-1957

CVE-2022-1957 concerns the WordPress plugin Comment License prior to version 1.4.0. Affected component: the plugin’s settings update flow, which lacks CSRF verification. Root cause: missing CSRF check during settings updates. Impact: could allow an attacker to alter settings by inducing a logged-...

WordPress plugin Admin Management Xtended 跨站请求伪造漏洞

WordPress and others are products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. Xtend and others are products of the Eclipse Foundation. Xtend is a general-purpose high-level programming language for the Java Virtual Machine. WordPress...

WordPress plugin Comment License 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. versions of the WordPress Comment License plugin prior to 1.4.0 are vulnerable to cross-site request...

Improper Input Validation

In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe state. A flaw was found in the Puppet...

Atlassian Jira 8.5.x < 8.18.0 (JRASERVER-72575)

The version of Atlassian Jira installed on the remote host is prior to 8.5.x 8.18.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-72575 advisory. - Information disclosure issue in the comment notification feature - CVE-2021-39120 CVE-2021-39120 Note that Nessus has...

The fee is not paid as intended for put orders

Lines of code Vulnerability details Impact MEDIUM - functions of the protocol could be impacted For put options, the fees are not paid as intended. Proof of Concept poc0: fee on non-exercised put option poc0 shows that fee is applied for put option, even though the option was not exercised. poc1:...

CVE-2022-34133

Jorani v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Comment parameter at application/controllers/Leaves.php...

Cross site scripting

Benjamin BALET Jorani v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Comment parameter at application/controllers/Leaves.php...

CVE-2022-34133

Jorani v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Comment parameter at application/controllers/Leaves.php...

CVE-2022-34133

Jorani v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Comment parameter at application/controllers/Leaves.php...

Jorani 跨站脚本漏洞

Benjamin BALET Jorani is a leave management system from the French personal developer Benjamin BALET. Designed to provide small organizations with a simple workflow for leave and overtime requests, Benjamin BALET Jorani version 1.0 contains a cross-site scripting vulnerability stemming from a lac...

PT-2022-22018 · Benjamin Balet · Jorani

Name of the Vulnerable Software and Affected Versions: Benjamin BALET Jorani version 1.0 Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability can be exploited via the Comment parameter at the application/controllers/Leaves.php endpoint. Recommendations...

puppetlabs-firewall: unmanaged rules could leave system in an unsafe state via duplicate comment

A flaw was found in the Puppet Firewall module. In certain situations, an unmanaged rule can exist on the target system that has the same comment as a rule specified in the manifest. When this condition is true, Puppet will ignore the unmanaged rule and continue to apply the rule in the manifest...

MAL-2022-2118 Malicious code in comment-watch-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cd02a3fc9a77347cd6b8710d4fa4d29e75db73c8caf2fb608e1ca6135569578 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in comment-watch-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cd02a3fc9a77347cd6b8710d4fa4d29e75db73c8caf2fb608e1ca6135569578 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Admin Management Xtended < 2.4.5 - Post Visibility/Date/Comment Status Update via CSRF

The plugin does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status draft, published, slug, post date, comment status enabled, disabled and more. The following PoC codes are f...

Admin Management Xtended < 2.4.5 - Post Visibility/Date/Comment Status Update via CSRF

The plugin does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status draft, published, slug, post date, comment status enabled, disabled and more. PoC The following PoC codes a...

CVE-2020-35597

Victor CMS 1.0 is vulnerable to SQL injection via cid parameter of admineditcomment.php, pid parameter of admineditpost.php, uid parameter of adminedituser.php, and edit parameter of adminupdatecategories.php...