5170 matches found
Can't set visibility on comment created via Activity Stream Gadget
I can't restrict the visibility of an comment created via the activity stream gadget. In our environment it is important for us to have this feature available everywhere where users are able to create comments on issues...
WordPress Plugin Events Manager Extended - Persistent Cross-Site Scripting
Author: Craw Email: [email protected] Software Link: http://wordpress.org/extend/plugins/events-manager-extended/ Version: 3.1.2 Category: webapplications ======================================================= + ExploiT 1 : If you are allowed to leave a comment: Persistent XSS Vulnerability: You...
GuestBookPlus HTML Injection / Comment Bypass
======================================================================= In the name of ALLAH ! ======================================================================= GuestBookPlus Script PHP HTML Injection Vuln. =======================================================================...
Fedora 14 : drupal-6.19-1.fc14 (2010-13031)
DRUPAL-SA-CORE-2010-002 Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script, for each site. Advisory ID: DRUPAL-SA-CORE-2010-002 Project: Drupal core Version: 5.x, 6.x Date:...
Fedora 13 : drupal-6.19-1.fc13 (2010-12753)
DRUPAL-SA-CORE-2010-002 Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script, for each site. Advisory ID: DRUPAL-SA-CORE-2010-002 Project: Drupal core Version: 5.x, 6.x Date:...
Fedora 12 : drupal-6.19-1.fc12 (2010-12742)
DRUPAL-SA-CORE-2010-002 Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script, for each site. Advisory ID: DRUPAL-SA-CORE-2010-002 Project: Drupal core Version: 5.x, 6.x Date:...
CVE-2010-2759: Undefined Security Weakness
Bugzilla 2.23.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2, when PostgreSQL is used, does not properly handle large integers in 1 bug and 2 attachment phrases, which allows remote authenticated users to cause a denial of service bug invisibility via a crafted...
SA-CORE-2010-002 - Drupal core - Multiple vulnerabilities
Multiple vulnerabilities and weaknesses were discovered in Drupal. OpenID authentication bypass The OpenID module provides users the ability to login to sites using an OpenID account. The OpenID module doesn't implement all the required verifications from the OpenID 2.0 protocol and is vulnerable...
Cross site scripting
Cross-site scripting XSS vulnerability in 2daybiz Custom T-Shirt Design Script allows remote attackers to inject arbitrary web script or HTML via a review comment...
CVE-2010-2692
Cross-site scripting XSS vulnerability in 2daybiz Custom T-Shirt Design Script allows remote attackers to inject arbitrary web script or HTML via a review comment...
CVE-2010-2692: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in 2daybiz Custom T-Shirt Design Script allows remote attackers to inject arbitrary web script or HTML via a review comment...
CVE-2010-2624
Multiple SQL injection vulnerabilities in iScripts EasySnaps 2.0 allow remote attackers to execute arbitrary SQL commands via the 1 comment parameter to addcomments.php, 2 values parameter to tagsdetails.php, or 3 begin parameter to greetings.php...
CVE-2009-4904: Undefined Security Weakness
article.php in oBlog does not properly restrict comments, which allows remote attackers to cause a denial of service blog spam via a comment=new action...
Cross site scripting
Cross-site scripting XSS vulnerability in class/tools.class.php in AneCMS Blog 1.3 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the comment variable to modules/blog/index.php...
CVE-2010-2437: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in class/tools.class.php in AneCMS Blog 1.3 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the comment variable to modules/blog/index.php...
Mozilla Products Frame Comment Objects Manipulation Memory Corruption (CVE-2006-6504)
There exists a memory corruption vulnerability in Mozilla Foundation's family of browser products. The flaw exists in specific dynamic manipulations of external Document Object Model DOM objects, specifically comment objects, using scripting techniques. A remote attacker can exploit this...
CVE-2009-4874
TalkBack 2.3.14 does not properly restrict access to the edit comment feature comments.php, which allows remote attackers to modify comments...
Design/Logic Flaw
TalkBack 2.3.14 does not properly restrict access to the edit comment feature comments.php, which allows remote attackers to modify comments...
CVE-2009-4874
CVE-2009-4874 affects TalkBack 2.3.14 where the edit comment feature (comments.php) does not correctly enforce access control, allowing remote modification of comments. The root cause is insufficient access restrictions on the edit-comment functionality. Documents do not provide a confirmed patch...