CVE-2017-9513

Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & receive notifications when comments are added to the watched page, and vote & watch JIRA issues that they do not have access to, although th...

Valve: Read Access to all comments on unauthorized forums' discussions! IDOR!

hi, For a forum's discussion, only moderator+ ranks are allowed to view comments which have been deleted by a officer/moderator . I have found an issue where a member who is not allowed to view deleted comments can get read access to the deleted comments on a forum's discussion. Also, a non-membe...

CVE-2018-5370

BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI...

CVE-2018-5370

BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI...

Design/Logic Flaw

BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI...

CVE-2018-5370

CVE-2018-5370 affects BizLogic xnami 1.0, a PHP-based image sharing script. The issue is a Cross-Site Scripting (XSS) vulnerability via the comment parameter in the addComment action to the /media/ajax URI. The root cause is insufficient input sanitization on the comment field, enabling injection...

PT-2018-16927

Name of the Vulnerable Software and Affected Versions BizLogic xnami version 1.0 Description The issue allows for XSS via the comment parameter in an addComment action to the "/media/ajax" API endpoint. Recommendations For BizLogic xnami version 1.0, avoid using the comment parameter in the...

CVE-2018-5370: Improper Neutralization of Input During Web Page Generation

BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI...

Xnami Image Sharing 1.0 Cross Site Scripting

Exploit Title: Xnami Image Sharing - Persistent XSS Vulnerability Google Dork: " Copyright 2017 xnami. " & 2018 Date: 11-01-2018 Exploit Author: Dennis Veninga Contact Author: d.veninga at networking4all.com Vendor Homepage: bizlogicdev.com Version: 1.0 CVE-ID: CVE-2018-5370 Xnami facilitates the...

Xnami 1.0 - Cross-Site Scripting

Xnami 1.0 - Cross-Site Scripting Exploit Title: Xnami Image Sharing - Persistent XSS Vulnerability Google Dork: " Copyright 2017 xnami. " & 2018 Date: 11-01-2018 Exploit Author: Dennis Veninga Contact Author: d.veninga at networking4all.com Vendor Homepage: bizlogicdev.com Version: 1.0 CVE-ID:...

Xnami 1.0 - Cross-Site Scripting

Exploit Title: Xnami Image Sharing - Persistent XSS Vulnerability Google Dork: " Copyright 2017 xnami. " & 2018 Date: 11-01-2018 Exploit Author: Dennis Veninga Contact Author: d.veninga at networking4all.com Vendor Homepage: bizlogicdev.com Version: 1.0 CVE-ID: CVE-2018-5370 Xnami facilitates the...

Ubiquiti Inc.: Reflected XSS

Due to the lack of sanitisation in the commend area, with a especially crafted message, is possible to execute a XSS with the "preview" function. If a draft is save, is possible to exploit this bug using as and stored-XSS. The "New Discussion" page on the Spanish and Portuguese forums have a...

Paragon Initiative Enterprises: Airship: Persistent XSS via Comment

Affected: Airship 2.0.0 commit 15bdc0d CVSS ---- Medium 6.1 https://www.first.org/cvss/calculator/3.0CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Description ----------- The "name" field of a comment on a blog post is vulnerable to persistent XSS. When replying to a comment, the comment name is...

Vanilla Forums Cross-Site Request Forgery Vulnerability

Vanilla Forums is a Canadian company Vanilla Forums PHP-based open source forum program . A cross-site request forgery vulnerability exists in versions of Vanilla Forums prior to 2.1.5. A remote attacker can exploit this vulnerability to delete topics and comments on the forum...

CVE-2017-1000432: Cross-Site Request Forgery (CSRF)

Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access...

CVE-2015-7324

Multiple cross-site scripting XSS vulnerabilities in helpers/comment.php in the StackIdeas Komento comkomento component before 2.0.5 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the 1 img or 2 url tag of a new comment...

CVE-2017-17792

Cross site scripting XSS vulnerability in the markupcleanhref function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitrary JavaScript via a comment...

CVE-2017-17792

Cross site scripting XSS vulnerability in the markupcleanhref function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitrary JavaScript via a comment...

CVE-2017-17792

Cross site scripting XSS vulnerability in the markupcleanhref function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitrary JavaScript via a comment...

Cross site scripting

Cross site scripting XSS vulnerability in the markupcleanhref function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitrary JavaScript via a comment...