70 matches found
CVE-2024-4886 BuddyBoss Platform < 2.6.0 - Subscriber+ Comment on Private Post via IDOR
The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in the request...
CVE-2024-25983 Msa-24-0006: idor on dashboard comments block
Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available e.g., on their profile page...
Threat Actors Using Obfuscation in Attempt to Evade Detection
As part of our product lineup, we offer security monitoring and malware removal services to our Wordfence Care and Response customers. In the event of a security incident, our incident response team will investigate the root cause, find and remove malware from your site, and help with other...
WordPress Multicollab – Google Doc-Style Editorial Commenting for WordPress Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)
Software Multicollab – Google Doc-Style Editorial Commenting for WordPress Type Plugin Vulnerable versions = 3.1 Fixed in 3.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 946cd7dfe9f...
Code injection
Leantime is a lean open source project management system. Starting in version 2.3.21, an authenticated user with commenting privileges can inject malicious Javascript into a comment. Once the malicious comment is loaded in the browser by a user, the malicious Javascript code executes. As of time ...
CVE-2023-33961 Leantime Stored Cross-site Scripting Vulnerability
Leantime is a lean open source project management system. Starting in version 2.3.21, an authenticated user with commenting privileges can inject malicious Javascript into a comment. Once the malicious comment is loaded in the browser by a user, the malicious Javascript code executes. As of time ...
PT-2023-17311 · Unknown · Thorsten/Phpmyfaq
Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue concerns improper access control in the thorsten/phpmyfaq GitHub repository. Specifically, when FAQ News is marked as inactive in settings and comments are enabled, it allows...
XWiki Platform 安全漏洞
XWiki Platform is a suite of wiki platforms for creating web collaboration applications from the French company XWiki. A security vulnerability exists in XWiki Platform, which stems from the fact that any user with commenting privileges can use an asynchronous macro that allows them to execute an...
vulnerability-lookup
Vulnerability-Lookup !Vulnerability-Lookup logodocs/stat...
Amasty Blog commenting feature cross-site scripting vulnerability
Amasty Blog is a web page extension of Amasty Inc. A cross-site scripting vulnerability exists in the commenting functionality of Amasty Blog Pro version 2.10.3, which can be exploited by attackers to inject cross-site code and launch XSS attacks...
PT-2022-22870 · Amasty · Amasty Blog
Name of the Vulnerable Software and Affected Versions: Amasty Blog version 2.10.3 Description: The issue is related to Cross Site Scripting XSS via the leave comment functionality. This means an attacker could potentially inject malicious scripts into the website, affecting user sessions...
Friday Squid Blogging: Squid Images
iStock has over 13,000 royalty-free images of squid. As usual, you can also use this squid post to talk about the security stories in the news that I havent covered. Read my blog posting guidelines here...
WordPress Multicollab – Google Doc-Style Editorial Commenting for WordPress plugin <= 2.0.3 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Multicollab – Google Doc-Style Editorial Commenting for WordPress plugin versions = 2.0.3. Solution Update the WordPress Multicollab – Google Doc-Style Editorial Commenting plugin to the latest available version at least 2.0.4...
UBUNTU-CVE-2021-39918
Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows a user to add comments to a vulnerability which cannot be accessed...
PT-2021-22764 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab EE versions 11.1 through 14.3.5 GitLab EE versions 14.4 through 14.4.3 GitLab EE versions 14.5 through 14.5.1 Description: The issue allows a user to add comments to a vulnerability that they cannot access due to incorrect authorizatio...
PortlandLabs Concrete CMS Cross-Site Scripting Vulnerability (CNVD-2021-76079)
PortlandLabs Concrete Cms is a team-oriented open source content management system for the United States PortlandLabs . A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS that stems from the failure of the website field of the product's podcast comment feature to properly...
PortlandLabs Concrete CMS Cross-Site Scripting Vulnerability (CNVD-2021-76088)
PortlandLabs Concrete Cms is a team-oriented open source content management system for the United States PortlandLabs . A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS that stems from the failure of the website field of the product's podcast comment feature to properly...
TikTok: BYPASSING COMMENTING ON RESTRICTED AUDIENCE VIDEOS
A vulnerability was identified in TikTok comments which could have potentially allowed users to bypass the commenting restriction by responding to existing comments via video message. We thank @boynamedboy for reporting this to our team and confirming the resolution...
Mattermost: Privilege Escalation leading to post in channel without having privilege
Hi H1, mattermost.cloud has a feature of making a channel and once its set to public any other user can join the channel and post comments on that channel. In System Console -- Channel -- Permission channel owner can assign wether member can post comment or not. Once channel owner selects that...