5983 matches found
Publify security vulnerabilities
Publify is a simple but full-featured web publishing software.An access control error vulnerability exists in versions of Publify prior to 9.2.8. The vulnerability stems from an access control error in draft mode, which could be exploited by an attacker to comment on articles in draft mode...
Throws SPAM Away < 3.3.1 - Comment Deletion via CSRF
The plugin does not have CSRF checks in place when deleting comments either all, spam, or pending, allowing attackers to make a logged in admin delete comments via a CSRF attack PoC To delete all comments...
GHSA-2P28-5MVP-2J2R Drupal Comment reply form allows access to restricted content
In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the...
Drupal Comment reply form allows access to restricted content
In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the...
org.jenkins-ci.plugins:github-branch-source (>=0.1-beta-1, <=1.10.1), org.jenkins-ci.plugins:github-organization-folder (>=1.0-beta-1, <=1.5) +2 more potentially affected by CVE-2018-1000182 via org.jenkins-ci.plugins:git (2.3)
org.jenkins-ci.plugins:git MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:github-branch-source =0.1-beta-1, =1.0-beta-1, =1.0, =1.0.0, =1.0.3 Source cves:...
org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.0.2), org.jenkins-ci.plugins:github-branch-source (>=2.0.1, <=2.0.8) +2 more potentially affected by CVE-2018-1000182 via org.jenkins-ci.plugins:git (2.6.4)
org.jenkins-ci.plugins:git MAVEN version 2.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source 2.0.2 - org.jenkins-ci.plugins:github-branch-sourc...
org.jenkins-ci.plugins:github-pr-comment-build (>=1.0, <=1.1) potentially affected by CVE-2018-1000185 via org.jenkins-ci.plugins:github-branch-source (1.10)
org.jenkins-ci.plugins:github-branch-source MAVEN version 1.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:github-branch-source and may be impacted: - org.jenkins-ci.plugins:github-pr-comment-build =1.0, =1.1 Source cves:...
org.jenkins-ci.plugins:github-branch-source (>=0.1-beta-1, <=1.10.1), org.jenkins-ci.plugins:github-organization-folder (>=1.0-beta-1, <=1.5) +2 more potentially affected by CVE-2018-1000110 via org.jenkins-ci.plugins:git (2.3)
org.jenkins-ci.plugins:git MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:github-branch-source =0.1-beta-1, =1.0-beta-1, =1.0, =1.0.0, =1.0.3 Source cves:...
org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.0.2), org.jenkins-ci.plugins:github-branch-source (>=2.0.1, <=2.0.8) +2 more potentially affected by CVE-2018-1000110 via org.jenkins-ci.plugins:git (2.6.4)
org.jenkins-ci.plugins:git MAVEN version 2.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source 2.0.2 - org.jenkins-ci.plugins:github-branch-sourc...
Drupal REST API can bypass comment approval
In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services rest module enabled, the...
GHSA-P8G6-5MG7-9R5Q Drupal REST API can bypass comment approval
In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services rest module enabled, the...
Moodle does not properly restrict comment capabilities
comment/lib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not properly restrict comment capabilities, which allows remote attackers to post a comment by leveraging the guest role and operating on a front-page activity...
GHSA-62WV-866C-RH86 Moodle does not properly restrict comment capabilities
comment/lib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not properly restrict comment capabilities, which allows remote attackers to post a comment by leveraging the guest role and operating on a front-page activity...
TOTOLINK N600R Buffer Overflow Vulnerability (CNVD-2022-50672)
TOTOLINK N600R is a wireless router from Taiwan-based TOTOLINK Electronics, Inc. A buffer overflow vulnerability exists in TOTOLINK N600R V4.3.0cu.7647B20210106, which stems from a lack of length validation of the comment parameter in the FUN00418f10 function, which can be exploited by attackers ...
TOTOLINK N600R Buffer Overflow Vulnerability
TOTOLINK N600R is a wireless router from Taiwan, China-based Gion Electronics TOTOLINK.A buffer overflow vulnerability exists in TOTOLINK N600R V4.3.0cu.7647B20210106, which stems from a lack of length validation of the comment parameter in the FUN004200c8 function. An attacker could exploit this...
TOTOLINK N600R Buffer Overflow Vulnerability (CNVD-2022-50671)
TOTOLINK N600R is a wireless router from Taiwan-based TOTOLINK Electronics, Inc. A buffer overflow vulnerability exists in TOTOLINK N600R V4.3.0cu.7647B20210106, which stems from a lack of length validation of the comment parameter in the FUN00418c24 function, which can be exploited by attackers ...
CVE-2022-29397
TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN004196c8...
CVE-2022-29396
TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN00418f10...