4199 matches found
Drupal 8.x < 8.4.5 Multiple Vulnerabilities
According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities : - A flaw exists with the Comment Reply Form. An authenticated remote attacker could add or view comments that they do not have access to. CVE-2017-6926 - A flaw exists with the...
Drupal 7.x < 7.57 Multiple Vulnerabilities
According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities : - A flaw exists with the Comment Reply Form. An authenticated remote attacker could add or view comments that they do not have access to. CVE-2017-6926 - A flaw exists with the...
Drupal 8.5.x < 8.5.0-rc1 Multiple Vulnerabilities
According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities : - A flaw exists with the Comment Reply Form. An authenticated remote attacker could add or view comments that they do not have access to. CVE-2017-6926 - A flaw exists with the...
Drupal 8.x < 8.1.10 Multiple Vulnerabilities
According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities : - A flaw exists that is due to the program allowing users who have rights to edit a node to set the visibility for comments on that node. This may allow an authenticated remote...
CVE-2018-18919
The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area...
CVE-2018-18919
The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area...
CVE-2018-18919
The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area...
Restricted Work Log entries show in the Activity Stream in JIRA Server
This is a regression of bug JRASERVER-34022: Restricted Work Log entries show in the Activity Stream in JIRA Server fixed in JIRA Server including JIRA Core 7.3.8|https://jira.atlassian.com/browse/JRASERVER-34022. Apparently this is a regression and users that are not meant to see the worklogs ca...
freetype: mishandling ps_parser_skip_PS_token in an FT_New_Memory_Face operation in skip_comment, psaux/psobjs.c, leads to a buffer over-read
FreeType before 2.6.1 has a buffer over-read in skipcomment in psaux/psobjs.c because psparserskipPStoken is mishandled in an FTNewMemoryFace operation...
New APT Could Signal Reemergence of Notorious Comment Crew
A recently observed APT campaign, dubbed Operation Oceansalt, could herald the return of the infamous China-linked hacking group known as Comment Crew or APT1. Attacks are cunning and are defined by their their deep targeting and use of an innovative multi-wave attack methodology. Operation...
Information Disclosure
github.com/go-gitea/gitea is vulnerable to information disclosure attacks. The vulnerability exists where all users emails would be disclosed when an issue comment mail is sent out when it was not supposed to, causing the information disclosure vulnerability...
CVE-2018-14802
Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini C1, FRENIC-Mini C2, FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace. The program does not properly check user-supplied comments which may allow for arbitrary remote code execution...
CVE-2018-17077
An issue was discovered in yiqicms through 2016-11-20. There is stored XSS in comment.php because a length limit can be bypassed...
CVE-2018-16779
BlogCMS through 2016-10-25 has XSS via a comment...
CVE-2018-16780
Complete Responsive CMS Blog through 2018-05-20 has XSS via a comment...
CVE-2018-16779
BlogCMS through 2016-10-25 has XSS via a comment...
CVE-2018-16779
BlogCMS through 2016-10-25 has XSS via a comment...
CVE-2018-16779
CVE-2018-16779 affects BlogCMS (through 2016-10-25) with a reflected/Stored XSS via a comment. The connected records confirm the issue existence and CVSS details (CVSS2 base 4.3, CVSS3 base 6.1) but do not provide affected versions beyond the date, or concrete exploitation details, patches, or mi...
CVE-2018-16780
CVE-2018-16780 affects Complete Responsive CMS Blog up to 2018-05-20 and is due to an XSS via user comments. The available documents confirm the vulnerability type but do not provide product version details, exact vulnerable components, root cause specifics, exploit information, or remediation st...