DRUPAL-CORE-2018-001

This security advisory fixes multiple vulnerabilities in both Drupal 7 and Drupal 8. See below for a list. Comment reply form allows access to restricted content - Critical - Drupal 8 - CVE-2017-6926 Users with permission to post comments are able to view content and comments they do not have...

drupal -- Drupal Core - Multiple Vulnerabilities

Drupal Security Team reports: CVE-2017-6926: Comment reply form allows access to restricted content CVE-2017-6927: JavaScript cross-site scripting prevention is incomplete CVE-2017-6928: Private file access bypass - Moderately Critical CVE-2017-6929: jQuery vulnerability with untrusted domains -...

Comment reply form allows access to restricted content.

More info at https://www.drupal.org/SA-CORE-2018-001...

Comment reply form allows access to restricted content.

More info at https://www.drupal.org/SA-CORE-2018-001...

CVE-2017-18092

The print snippet resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a comment on the snippet...

CVE-2018-6845

PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field...

CVE-2018-6845

PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field...

Design/Logic Flaw

PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field...

CVE-2018-6845

The CVE-2018-6845 entry concerns PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 and a Cross-Site Scripting (XSS) vulnerability exposed via the Leave Comment field. The CNVD/NVD records confirm a stored/reflected XSS pathway where user-supplied input in comments can inject arbitrary script...

CVE-2018-6845

PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field...

Multi Language Olx Clone Script - Cross-Site Scripting

Exploit Title: Multi Language Olx Clone Script - Stored XSS Date: 08.02.2018 Exploit Author: Varun Bagaria Web: Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/olx-clone/ Category: Web Application Version:2.0.6 Tested on: Windows 7 CVE: NA...

CVE-2017-9513

Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & receive notifications when comments are added to the watched page, and vote & watch JIRA issues that they do not have access to, although th...

Valve: Read Access to all comments on unauthorized forums' discussions! IDOR!

hi, For a forum's discussion, only moderator+ ranks are allowed to view comments which have been deleted by a officer/moderator . I have found an issue where a member who is not allowed to view deleted comments can get read access to the deleted comments on a forum's discussion. Also, a non-membe...

CVE-2018-5370

BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI...

CVE-2018-5370

BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI...

Design/Logic Flaw

BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI...

CVE-2018-5370

CVE-2018-5370 affects BizLogic xnami 1.0, a PHP-based image sharing script. The issue is a Cross-Site Scripting (XSS) vulnerability via the comment parameter in the addComment action to the /media/ajax URI. The root cause is insufficient input sanitization on the comment field, enabling injection...

Xnami 1.0 - Cross-Site Scripting

Xnami 1.0 - Cross-Site Scripting Exploit Title: Xnami Image Sharing - Persistent XSS Vulnerability Google Dork: " Copyright 2017 xnami. " & 2018 Date: 11-01-2018 Exploit Author: Dennis Veninga Contact Author: d.veninga at networking4all.com Vendor Homepage: bizlogicdev.com Version: 1.0 CVE-ID:...

Xnami 1.0 - Cross-Site Scripting

Exploit Title: Xnami Image Sharing - Persistent XSS Vulnerability Google Dork: " Copyright 2017 xnami. " & 2018 Date: 11-01-2018 Exploit Author: Dennis Veninga Contact Author: d.veninga at networking4all.com Vendor Homepage: bizlogicdev.com Version: 1.0 CVE-ID: CVE-2018-5370 Xnami facilitates the...

Xnami Image Sharing 1.0 Cross Site Scripting

Exploit Title: Xnami Image Sharing - Persistent XSS Vulnerability Google Dork: " Copyright 2017 xnami. " & 2018 Date: 11-01-2018 Exploit Author: Dennis Veninga Contact Author: d.veninga at networking4all.com Vendor Homepage: bizlogicdev.com Version: 1.0 CVE-ID: CVE-2018-5370 Xnami facilitates the...