4187 matches found
CVE-2021-24393
The CVE-2021-24393 entry concerns the WordPress plugin Comment Highlighter (versions up to 0.13). The vulnerability is a SQL injection caused by unsanitized/unchecked c GET parameters that are inserted into an SQL statement. The provided connected documents corroborate this exact flaw across mult...
WordPress 插件 SQL注入漏洞
WordPress plugin is an open source application plugin for WordPress. A SQL injection vulnerability exists in WordPress plugin Comment Highlighter 0.13 and earlier versions, which stems from a SQL injection caused by c GET parameters not being properly cleaned up, escaped, or validated prior to...
WordPress Comment Link Remove and Other Comment Tools plugin <= 2.1.4 - Cross-Site Request Forgery (CSRF) vulnerability leading to bulk comment deletion
Cross-Site Request Forgery CSRF vulnerability leading to bulk comment deletion discovered by Martin Vierula Trustwave in WordPress Comment Link Remove and Other Comment Tools plugin versions = 2.1.4. Solution Update the WordPress Comment Link Remove and Other Comment Tools plugin to the latest...
CVE-2021-20775
Improper input validation vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the data of Comment and Space without the viewing privilege...
Input validation
Improper input validation vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the data of Comment and Space without the viewing privilege...
CVE-2021-20775
Improper input validation vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the data of Comment and Space without the viewing privilege...
Cybozu Garoon Information Disclosure Vulnerability (CNVD-2021-59718)
Cybozu Garoon, a portal-based OA system of Cybozu Japan, is vulnerable to information disclosure. An attacker can use this vulnerability to obtain data from Comment and Space without viewing privileges...
Cybozu Garoon 输入验证错误漏洞
Cybozu Garoon, a portal-based OA system of Cybozu Japan, is vulnerable to information disclosure. An attacker can use this vulnerability to obtain data from Comment and Space without viewing privileges...
Edit Comments <= 0.3 - Unauthenticated SQL Injection
The plugin does not sanitise, validate or escape the jaleditcomments GET parameter before using it in a SQL statement, leading to a SQL injection issue Post a comment on a page, then open https://example.com//?jaleditcomments=7%20AND%20SELECT%209114%20FROM SELECTSLEEP5wjzD...
Comment Highlighter <= 0.13 - Authenticated SQL Injection
A c GET parameter of the plugin is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. GET...
Halo 跨站脚本漏洞
Halo is a light, clean and powerful Java blogging system. Halo version 0.4.3 suffers from a cross-site scripting vulnerability that can be exploited by attackers via CommentAuthorUrl...
Magecart Hackers Hide Stolen Credit Card Data Into Images for Evasive Exfiltration
Cybercrime actors part of the Magecart group have latched on to a new technique of obfuscating the malware code within comment blocksBlockcomment and encoding stolen credit card data into images and other files hosted on the server, once again demonstrating how the attackers are continuously...
Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system
✍️ Description I found a stored XSS in your project which is lead by adding client's comment. 🕵️♂️ Proof of Concept Steps to reproduce: 1. Create a Client. 2. Enter " in the comments. 3. Save and you will see XSS. 💥 Impact This vulnerability is capable of stored XSS...
Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system
✍️ Description stored xss via client comment 🕵️♂️ Proof of Concept 1. First goto http://localhost/online-invoice3/app/clientsview.php and create a new client .\ During creation put bellow xss payload in comment section and save it .\ xss"' 2. Now any user open this client then xss is executed...
Cross-site Scripting (XSS) - Stored in bigprof-software/online-rental-property-manager
💥 BUG xss via landlord comment 💥 VERSION TESTED latest version as of 1/7/21 💥 IMPACT xss allow to execute arbitary javascript in vicitm account 💥 STEP TO REPRODUCE 1. first goto http://localhost/online-rental/app/rentalownersview.php and add a new landlord .\ During creation put bellow xss payloa...
Advisory ROSA-SA-2021-1905
Software: libxml2 2.9.1 OS: Cobalt 7.9 CVE-ID: CVE-2013-0339 CVE-Crit: HIGH CVE-DESC: libxml2 before 2.9.1 does not handle external entity extension properly if the application developer does not use the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to...
Information disclosure issue in the comment notification feature - CVE-2021-39120
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to learn when a restricted comment is removed from an issue via an information disclosure vulnerability in the comment notification functionality. The affected versions are before version 8.18.0. Affected versions:...
Information disclosure issue in the comment notification feature - CVE-2021-39120
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to learn when a restricted comment is removed from an issue via an information disclosure vulnerability in the comment notification functionality. The affected versions are before version 8.18.0. Affected versions:...
