3659 matches found
Webpack 安全漏洞
Webpack is a module packager. Its primary purpose is to bundle JavaScript files for use in the browser, but it is also capable of converting, bundling, or packaging almost any resource or asset. A security vulnerability exists in Webpack that stems from a vulnerability that could allow a remote...
CVE-2023-26781
SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center -Reader Comments -Search...
CVE-2023-26781
SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center -Reader Comments -Search...
Sql injection
SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center -Reader Comments -Search...
PT-2023-20796 · Mccms · Mccms
Name of the Vulnerable Software and Affected Versions: mccms version 2.6 Description: The issue allows remote attackers to run arbitrary SQL commands via the Author Center -Reader Comments -Search function. This can be exploited by accessing the Author Center and then navigating to Reader Comment...
CVE-2023-26781
SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center -Reader Comments -Search...
CVE-2021-44465
Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future notifications and comments related to arbitrary business records in the system, via crafted RPC requests...
PT-2023-9990 · Arc2 · Arc2
Name of the Vulnerable Software and Affected Versions: ARC aka ARC2 through 2011-12-01 Description: The issue allows blind SQL Injection in the getTriplePatternSQL function within ARC2 StoreSelectQueryHandler.php via comments in a SPARQL WHERE clause. Recommendations: For ARC aka ARC2 through...
Stored Cross-Site Scripting (XSS)
phpmyfaq is vulnerable to Stored Cross-Site Scripting XSS attacks. The vulnerability is due to a lack of sanitization in the FAQ news email field in comments, allowing an attacker to inject and execute malicious JavaScript in the victim's browser...
GHSA-GPQ5-7P34-VQX5 XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode
Impact It's possible to display any page you cannot access through the combination of the async and display macro. Steps to reproduce: 1. Enable comments for guests by giving guests comment rights 2. As a guest, create a comment with content asyncdisplay reference="Menu.WebHome" //async 3. Open t...
GHSA-X37V-36WV-6V6H Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml
Impact The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. As a consequence, any code relying on this "restricte...
GitLab 安全漏洞
GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A security vulnerability exists in GitLab, which stems from an insecure direct...
PT-2023-22198
Name of the Vulnerable Software and Affected Versions XWiki Commons versions 4.2-milestone-1 through 14.6 RC1 Description The "restricted" mode of the HTML cleaner in XWiki only escaped and -tags but neither attributes that can be used to inject scripts nor other dangerous HTML tags like . This...
CVE-2023-29112
The SAP Application Interface Message Monitoring - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exploitations, an attacker can cause limite...
Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments
Impact A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core. An attacker could create a specially crafted comment, resulting in the execution of malicious script code in the user's browser when displaying the comment. Patches The vulnerability...
GHSA-622W-995C-3C3H Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments
Impact A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core. An attacker could create a specially crafted comment, resulting in the execution of malicious script code in the user's browser when displaying the comment. Patches The vulnerability...
WordPress Comments Ratings Plugin <= 1.1.6 is vulnerable to Cross Site Request Forgery (CSRF)
Software Comments Ratings Type Plugin Vulnerable versions = 1.1.6 Fixed in 1.1.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-23704 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID cfc969289e49 Credits yuyudhn Required...
CVE-2023-29015 Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted comment, resulting ...
CVE-2023-29015 Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted comment, resulting ...