5751 matches found
CVE-2024-50810
The hopetree izone lts version c011b48 is vulnerable to a Cross-Site Scripting (XSS) flaw within the article comment function. The root cause is located in the AddCommintView() function inside hin he ext{apps extbackslash}comment extbackslash views.py, which fails to securely filter user input be...
IZONE security vulnerabilities
izone is a Django-based blogging project by the individual developer of Hopetree. A security vulnerability exists in izone, which stems from the AddCommintView function in appscommentviews.py contains a cross-site scripting XSS vulnerability...
CVE-2024-50123 bpf: Add the missing BPF_LINK_TYPE invocation for sockmap
In the Linux kernel, the following vulnerability has been resolved: bpf: Add the missing BPFLINKTYPE invocation for sockmap There is an out-of-bounds read in bpflinkshowfdinfo for the sockmap link fd. Fix it by adding the missing BPFLINKTYPE invocation for sockmap link Also add comments for...
CVE-2024-50581
In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag...
CVE-2024-50581
In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag...
CVE-2024-50581
In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag...
CVE-2024-10433
A vulnerability was found in Project Worlds Simple Web-Based Chat Application 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument Name/Comment leads to cross site scripting. The attack may be launched...
CVE-2024-10433 Project Worlds Simple Web-Based Chat Application index.php cross site scripting
A vulnerability was found in Project Worlds Simple Web-Based Chat Application 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument Name/Comment leads to cross site scripting. The attack may be launched...
CVE-2024-10433: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in Project Worlds Simple Web-Based Chat Application 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument Name/Comment leads to cross site scripting. The attack may be launched...
CVE-2024-50581: Improper Neutralization of Input During Web Page Generation
In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag...
PT-2024-16279
Name of the Vulnerable Software and Affected Versions Project Worlds Simple Web-Based Chat Application version 1.0 Description A vulnerability was found in the file /index.php, where the manipulation of the Name/Comment argument leads to cross-site scripting. The attack can be launched remotely...
PT-2024-7631
Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2024.3.47707 Description The issue is related to improper HTML sanitization, which could lead to a cross-site scripting XSS attack via a comment tag. This vulnerability is associated with a lack of protecti...
CVE-2024-9829
The Download Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the 'dpwaphandledownloaduser' and 'dpwaphandledownloadcomment' functions in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, wit...
CVE-2024-9829 Download Plugin <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) User Metadata and Comment Download
The Download Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the 'dpwaphandledownloaduser' and 'dpwaphandledownloadcomment' functions in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, wit...
PT-2024-39871 · Unknown · Download Plugin
Name of the Vulnerable Software and Affected Versions: Download Plugin versions up to, and including, 2.2.0 Description: The issue allows authenticated attackers with Subscriber-level access and above to download any comment and metadata for any user, including sensitive information such as...
WordPress Download Plugin plugin <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) User Metadata and Comment Download vulnerability
Missing Authorization to Authenticated Subscriber+ User Metadata and Comment Download vulnerability discovered by WordFence in WordPress Plugin Download versions = 2.2.0...
OESA-2024-2228 json-lib security update
JSON-lib is a java library for transforming beans, maps, collections, java arrays and XML to JSON and back again to beans and DynaBeans. Security Fixes: util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.CVE-2024-47855...
openSUSE 15 Security Update : json-lib (SUSE-SU-2024:3543-1)
The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:3543-1 advisory. - CVE-2024-47855: Fixed mishandled unbalanced comment string bsc1231295 Tenable has extracted the preceding description block directly from the SUSE security...
Security update for json-lib
This update for json-lib fixes the following issues: CVE-2024-47855: Fixed mishandled unbalanced comment string bsc1231295 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command...