CVE-2023-41161: Improper Neutralization of Input During Web Page Generation

Multiple stored cross-site scripting XSS vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the key comment to different pages such as public key details, Export key, sign key, send to key server page, and fetch from key server page tab...

PT-2023-27837 · Usermin · Usermin

Name of the Vulnerable Software and Affected Versions: Usermin version 2.000 Description: Multiple stored cross-site scripting XSS vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the key comment to different pages, including public key details, Export key, sign...

CVE-2023-4713

The CVE-2023-4713 entry concerns IBOS OA 4.5.5 where the addComment function at ?r=weibo/comment/addcomment is vulnerable to SQL injection via the touid parameter. The vulnerability is described as critical, with potential high impact on confidentiality, integrity, and availability. The root caus...

PT-2023-30333

Name of the Vulnerable Software and Affected Versions IBOS OA version 4.5.5 Description A critical issue has been found that affects the addComment function of the file ?r=weibo/comment/addcomment. The manipulation of the touid argument leads to SQL injection. The exploit has been disclosed to th...

IBOS SQL Injection Vulnerability

IBOS is a collaborative office management system. An SQL injection vulnerability exists in IBOS OA version 4.5.5, which stems from the fact that incorrect manipulation of the touid in the addComment function of ?r=weibo/comment/addcomment can lead to SQL injection...

swapGivenInputAmount checks the wrong result out

Lines of code Vulnerability details Impact Wrong check amount results in unusable function. Proof of Concept swapGivenInputAmount calcaultes the value of result after calling swap. The check then requires that result 0. However, the comment states that amount cannot be less than 0...

CVE-2023-40042

TOTOLINK T10v2 5.9c.5061B20200511 has a stack-based buffer overflow in setStaticDhcpConfig in /lib/cstemodules/lan.so. Attackers can send crafted data in an MQTT packet, via the comment parameter, to control the return address and execute code...

TOTOLINK T10 Buffer Error Vulnerability

TOTOLINK T10 is a wireless network system router from China's Gion Electronics TOTOLINK. A buffer overflow vulnerability exists in TOTOLINK T10v2 version 5.9c.5061B20200511, which originates from the comment parameter in the setStaticDhcpConfig of /lib/cstemodules/lan.so that fails to correctly...

Cross-Site Scripting (XSS)

github.com/answerdev/answer is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the comment section of index.tsx, allowing an attacker to inject and execute malicious javascript...

CVE-2022-46485

Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable to Denial of Service if a survey contains a "Text Field", "Comment Field" or "Contact Details"...

CVE-2022-46485

Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable to Denial of Service if a survey contains a "Text Field", "Comment Field" or "Contact Details"...

CVE-2022-46485

Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable to Denial of Service if a survey contains a "Text Field", "Comment Field" or "Contact Details"...

CVE-2022-46485

Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable to Denial of Service if a survey contains a "Text Field", "Comment Field" or "Contact Details"...

Data Illusion Survey Software Solutions NGSurvey Security Breach

ngSurvey is a Data Illusion Survey Software Solutions by ngSurvey, Inc. A security vulnerability exists in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and earlier versions, which stems from vulnerability to denial-of-service attacks if a survey is submitted that contains Text Field,...

CVE-2022-46485: Allocation of Resources Without Limits or Throttling

Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable to Denial of Service if a survey contains a "Text Field", "Comment Field" or "Contact Details"...

CVE-2023-4047

creationtimestamp| type| source ---|---|--- 2023-08-01 18:38:28+00:00| seen| https://t.me/cibsecurity/67503 2023-08-02 18:10:05+00:00| seen| https://t.me/truesecator/4685 2023-09-20 10:12:47+00:00| published-proof-of-concept| Telegram/OrzbdSrsyNGre50gvdWTC8vdVTcvnVlN80j6OCu5SA6tOfA 2023-09-20...

Inability of Followers and Followees to Commenting

Lines of code Vulnerability details Impact The lack of functionality restricts interaction and engagement between the profile owner and their followers or the users they follow. This limitation diminishes the platform's value, as users who are interested in a post or have a genuine reason to...

CVE-2023-3862

A vulnerability was found in Travelmate Travelable Trek Management Solution 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Comment Box Handler. The manipulation of the argument comment leads to cross site scripting. The attack may be...

CVE-2023-3862

The CVE-2023-3862 issue affects Travelmate Travelable Trek Management Solution 1.0, specifically the Comment Box Handler component. The vulnerability is a Cross-Site Scripting flaw triggered by manipulating the comment parameter, with remote exposure and a high attack complexity. Exploitation is ...

CVE-2023-3862: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Travelmate Travelable Trek Management Solution 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Comment Box Handler. The manipulation of the argument comment leads to cross site scripting. The attack may be...