WordPress Multicollab – Google Doc-Style Editorial Commenting for WordPress Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)

Software Multicollab – Google Doc-Style Editorial Commenting for WordPress Type Plugin Vulnerable versions = 3.1 Fixed in 3.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 946cd7dfe9f...

Code injection

Leantime is a lean open source project management system. Starting in version 2.3.21, an authenticated user with commenting privileges can inject malicious Javascript into a comment. Once the malicious comment is loaded in the browser by a user, the malicious Javascript code executes. As of time ...

CVE-2023-33961 Leantime Stored Cross-site Scripting Vulnerability

Leantime is a lean open source project management system. Starting in version 2.3.21, an authenticated user with commenting privileges can inject malicious Javascript into a comment. Once the malicious comment is loaded in the browser by a user, the malicious Javascript code executes. As of time ...

CVE-2023-33961

Leantime is a lean open source project management system. Starting in version 2.3.21, an authenticated user with commenting privileges can inject malicious Javascript into a comment. Once the malicious comment is loaded in the browser by a user, the malicious Javascript code executes. As of time ...

CVE-2023-33961: Improper Neutralization of Input During Web Page Generation

Leantime is a lean open source project management system. Starting in version 2.3.21, an authenticated user with commenting privileges can inject malicious Javascript into a comment. Once the malicious comment is loaded in the browser by a user, the malicious Javascript code executes. As of time ...

PT-2023-24602

Name of the Vulnerable Software and Affected Versions Leantime versions 2.3.21 and later Description The issue allows an authenticated user with commenting privileges to inject malicious Javascript into a comment. When the malicious comment is loaded in the browser by a user, the malicious...

PT-2023-17311 · Unknown · Thorsten/Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue concerns improper access control in the thorsten/phpmyfaq GitHub repository. Specifically, when FAQ News is marked as inactive in settings and comments are enabled, it allows...

coderedcms (>=0.16.0, <=0.16.3), coop (>=2.6.0, <=2.6.5) +12 more potentially affected by CVE-2023-28837 via wagtail (2.6.3)

wagtail PYPI version 2.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coderedcms =0.16.0, =2.6.0, =8.12.6, =10.0.0, =8.0.0, =8.0.0, =0.1.4, =2.0.3, =0.9.1, =0.9.4 Source cves: CVE-2023-28837 Source advisory:...

XWiki Platform security vulnerabilities

XWiki Platform is a suite of wiki platforms for creating web collaboration applications from the French company XWiki. A security vulnerability exists in XWiki Platform, which stems from the fact that any user with commenting privileges can use an asynchronous macro that allows them to execute an...

vulnerability-lookup

Vulnerability-Lookup !Vulnerability-Lookup logodocs/stat...

Amasty Blog commenting feature cross-site scripting vulnerability

Amasty Blog is a web page extension of Amasty Inc. A cross-site scripting vulnerability exists in the commenting functionality of Amasty Blog Pro version 2.10.3, which can be exploited by attackers to inject cross-site code and launch XSS attacks...

PT-2022-22870 · Amasty · Amasty Blog

Name of the Vulnerable Software and Affected Versions: Amasty Blog version 2.10.3 Description: The issue is related to Cross Site Scripting XSS via the leave comment functionality. This means an attacker could potentially inject malicious scripts into the website, affecting user sessions...

Friday Squid Blogging: Squid Images

iStock has over 13,000 royalty-free images of squid. As usual, you can also use this squid post to talk about the security stories in the news that I havent covered. Read my blog posting guidelines here...

docku-build (0.1.0), molo-commenting (10.0.3) +5 more potentially affected by CVE-2022-24065 via cookiecutter (1.0.0)

cookiecutter PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cookiecutter and may be impacted: - docku-build 0.1.0 - molo-commenting 10.0.3 - molo-core =5.22.3, =0.0.1, =8.0.0, =8.0.0, =8.0.0, =8.3.3 Source cves: CVE-2022-24065 Sourc...

docku-build (0.1.0), molo-commenting (10.0.3) +5 more potentially affected by CVE-2022-24065 via cookiecutter (1.0.0)

cookiecutter PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cookiecutter and may be impacted: - docku-build 0.1.0 - molo-commenting 10.0.3 - molo-core =5.22.3, =0.0.1, =8.0.0, =8.0.0, =8.0.0, =8.3.3 Source cves: CVE-2022-24065 Sourc...

WordPress Multicollab – Google Doc-Style Editorial Commenting for WordPress plugin <= 2.0.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Multicollab – Google Doc-Style Editorial Commenting for WordPress plugin versions = 2.0.3. Solution Update the WordPress Multicollab – Google Doc-Style Editorial Commenting plugin to the latest available version at least 2.0.4...

UBUNTU-CVE-2021-39918

Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows a user to add comments to a vulnerability which cannot be accessed...

PT-2021-22764 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 11.1 through 14.3.5 GitLab EE versions 14.4 through 14.4.3 GitLab EE versions 14.5 through 14.5.1 Description: The issue allows a user to add comments to a vulnerability that they cannot access due to incorrect authorizatio...

PortlandLabs Concrete CMS Cross-Site Scripting Vulnerability (CNVD-2021-76088)

PortlandLabs Concrete Cms is a team-oriented open source content management system for the United States PortlandLabs . A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS that stems from the failure of the website field of the product's podcast comment feature to properly...

PortlandLabs Concrete CMS Cross-Site Scripting Vulnerability (CNVD-2021-76079)

PortlandLabs Concrete Cms is a team-oriented open source content management system for the United States PortlandLabs . A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS that stems from the failure of the website field of the product's podcast comment feature to properly...