CVE-2013-7196

static/ajax.php in PHPFox 3.7.3, 3.7.4, and 3.7.5 allows remote authenticated users to bypass intended "Only Me" restrictions and comment on a private publication via a request with a modified valitemid parameter for the publication...

Design/Logic Flaw

static/ajax.php in PHPFox 3.7.3, 3.7.4, and 3.7.5 allows remote authenticated users to bypass intended "Only Me" restrictions and comment on a private publication via a request with a modified valitemid parameter for the publication...

CVE-2013-7196

PHPFox 3.7.3–3.7.5 contains a flaw in static/ajax.php that allows remote authenticated users to bypass the "Only Me" privacy setting and post a comment on private publications by manipulating the val[item_id] parameter. The root cause is insufficient access control in AJAX comment/like handling, ...

Slack: CSRF on add comment section

Hi, Steps to repro: 1 Go to this link https://sehacure.slack.com/help/requests/237956 2 The malicious guy should now the request number and the username. 3 Open Tamper data using tamper data firefox addon,Fill the reply in the form. 4 Submit the request.You will see there are no anti-csrf token i...

Joomla! JV Comment扩展'id'参数SQL注入漏洞

BUGTRAQ ID: 64661 CVECAN ID: CVE-2014-0794 JV Comment是Joomla!的一个扩展，可以将评论系统添加到文章内。 JV Comment for Joomla!版本3.0.2，文件comjvcomment在实现上存在跨站脚本漏洞，这可使远程攻击者在comment.like操作的id参数，利用此漏洞注入任意Web脚本或HTML，从而查看、添加、修改、删除后端数据库内的信息。 0 Joomla! JV Comment 3.0.2 厂商补丁： Joomla! ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

SA-CONTRIB-2014-010 - Services - Access Bypass and Privilege Escalation

The Services module enables you to expose an API to third party systems using REST, XML-RPC or other protocols. User update access bypass vulnerability An authenticated user is able to assign additional roles to themselves, which means they can escalate their privileges by assigning an...

CVE-2014-0793

Multiple cross-site scripting XSS vulnerabilities in the StackIdeas Komento comkomento component before 1.7.3 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the 1 website or 2 latitude parameter in a comment to the default URI...

Sql injection

SQL injection vulnerability in the JV Comment comjvcomment component before 3.0.3 for Joomla! allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a comment.like action to index.php...

CVE-2014-0794

CVE-2014-0794 describes a SQL injection in Joomla! JV Comment (com_jvcomment) prior to 3.0.3. The vulnerability occurs in the id parameter of the comment.like action to index.php, allowing remote authenticated users to inject arbitrary SQL commands into the application's database. Affected softwa...

CVE-2014-0794

SQL injection vulnerability in the JV Comment comjvcomment component before 3.0.3 for Joomla! allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a comment.like action to index.php...

Joomla JV Comment 3.0.2 SQL Injection Vulnerability

Joomla JV Comment extension version 3.0.2 suffers from a remote SQL injection vulnerability. Product: JV Comment Joomla Extension Vendor: joomlavi.com Vulnerable Versions: 3.0.2 and probably prior Tested Version: 3.0.2 Advisory Publication: January 2, 2014 without technical details Vendor...

Joomla JV Comment 3.0.2 SQL Injection

Advisory ID: HTB23195 Product: JV Comment Joomla Extension Vendor: joomlavi.com Vulnerable Versions: 3.0.2 and probably prior Tested Version: 3.0.2 Advisory Publication: January 2, 2014 without technical details Vendor Notification: January 2, 2014 Vendor Patch: January 14, 2014 Public Disclosure...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Vessio NetBill 1.2 allow remote attackers to inject arbitrary web script or HTML via the 1 full name or 2 file title to accounts/admin/index.php or 3 comment parameter in the support page to accounts/index2.php...

@mention Notification for Comments on Restricted Page in Confluence 5.4.x

In Confluence 5.4.x versions, the user is getting comment notifications in a page that he's restricted to view. If you restrict an user to view or edit the page through 'Tools Restrictions' and then comment in a page, the user will get the notification about it in the Workbox. h4.Steps to...

@mention Notification for Comments on Restricted Page in Confluence 5.4.x

In Confluence 5.4.x versions, the user is getting comment notifications in a page that he's restricted to view. If you restrict an user to view or edit the page through 'Tools Restrictions' and then comment in a page, the user will get the notification about it in the Workbox. h4.Steps to...

@mention Notification for Comments on Restricted Page in Confluence 5.4.x

In Confluence 5.4.x versions, the user is getting comment notifications in a page that he's restricted to view. If you restrict an user to view or edit the page through 'Tools Restrictions' and then comment in a page, the user will get the notification about it in the Workbox. h4.Steps to...

Hiox Guest Book 5.0 Cross Site Scripting

Exploit Title : HIOX GUEST BOOK 5.0 HGB-5.0 Cross Site Scripting Author : JoKeRStEx Tested On : Windows Download Software Link : www.hscripts.com/scripts/php/downloads/HGB.zip Date : 03/01/2014 + P.O.C prompt'JoKeRStEx'" prompt'xss email'" prompt'xss comment'" + For test The Exploit Example...

SQL Injection in JV Comment Joomla Extension

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in JV Comment Joomla Extension, which can be exploited to perform SQL Injection attacks. 1 SQL Injection in JV Comment Joomla Extension: CVE-2014-0794 The vulnerability exists due to insufficient validation of "id" HTTP...

emlog code reuse vulnerability, password blasting and other impact-vulnerability warning-the black bar safety net

Brief description: emlog code reuse. You can ignore the CAPTCHA brush comments, ignoring the code to brute force the background. Detailed description: See two days emlog source code is also not white to see it. In the comment when the service side validation of the data code as follows:...

phpscup enterprise built Station system v1. 8. 2-stored xss vulnerability-vulnerability warning-the black bar safety net

Long time useless computer, recently busy Ah, just from the factory-do come back..... Just before this point of time on the Internet, ^^ looking for a source see directly the analogy recommended and download!!! phpscup enterprise built Station system v1. 8. 2 Analysis ing...... The online search...