4635 matches found
CVE-2024-6546: Exposure of Sensitive Information to an Unauthorized Actor
The One Click Close Comments plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.7.1. This is due to the plugin utilizing bootstrap and leaving test files with displayerrors on. This makes it possible for unauthenticated attackers to retrieve the ful...
PT-2024-37703 · WordPress · One Click Close Comments
Name of the Vulnerable Software and Affected Versions: One Click Close Comments plugin for WordPress versions up to and including 2.7.1 Description: The issue is related to Full Path Disclosure, which occurs because the plugin uses bootstrap and leaves test files with display errors on. This allo...
Heap-based Buffer Overflow
fiona is vulnerable to Heap-based Buffer Overflow. The vulnerability is due to improper handling of long filenames, comments, or extra fields in within zlib components that contain integer overflow vulnerabilities, which can result in an application crash or potential code execution...
Cross-Site Request Forgery (CSRF)
ProcessWire is vulnerable to Cross Site Request Forgery CSRF. The vulnerability is due to inadequate handling of comments functionality, which allows a remote attacker to comment as another user...
Cross Site Scripting(XSS)
Calibre-Web is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper sanitization performed by the cleanstring function, which allows an attacker perform XSS by inserting a payload into the comments field...
ProcessWire Cross Site Request Forgery vulnerability
Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to execute arbitrary code via a crafted HTML file to the comments functionality...
GHSA-R9VW-CJF9-XH4X ProcessWire Cross Site Request Forgery vulnerability
Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to execute arbitrary code via a crafted HTML file to the comments functionality...
CVE-2024-41597
Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment. NOTE: this is disputed by the Supplier because the product intentionally accepts anonymous, unauthenticated comments and thus there are fewer situations in which CSRF would be a useful...
CVE-2024-41597
Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment. NOTE: this is disputed by the Supplier because the product intentionally accepts anonymous, unauthenticated comments and thus there are fewer situations in which CSRF would be a useful...
CVE-2024-41597
Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to execute arbitrary code via a crafted HTML file to the comments functionality...
PT-2024-29454
Name of the Vulnerable Software and Affected Versions ProcessWire version 3.0.229 Description A Cross Site Request Forgery issue allows a remote attacker to execute arbitrary code via a crafted HTML file to the comments functionality. Recommendations For version 3.0.229, update to a newer version...
CVE-2024-41597
Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment. NOTE: this is disputed by the Supplier because the product intentionally accepts anonymous, unauthenticated comments and thus there are fewer situations in which CSRF would be a useful...
CVE-2024-41597
Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to execute arbitrary code via a crafted HTML file to the comments functionality...
PT-2024-28353
Name of the Vulnerable Software and Affected Versions janeczku Calibre-Web versions 0.6.0 through 0.6.21 Description The issue arises from improper sanitization performed by the clean string function, specifically in the way it handles HTML sanitization, making the edit book comments function...
PT-2024-5689
Name of the Vulnerable Software and Affected Versions Netcat CMS affected versions not specified Description The issue is related to the implementation of the deleteComment method in the comments module of the Netcat CMS system, which fails to take measures to protect the SQL query structure. Thi...
PT-2024-5691
Name of the Vulnerable Software and Affected Versions Netcat CMS affected versions not specified Description The issue exists due to insufficient protection of the web page structure in the comments module of the Netcat CMS system. This allows a remote attacker to execute arbitrary JavaScript cod...
PT-2024-5690 · Unknown · Netcat Cms
Name of the Vulnerable Software and Affected Versions: Netcat CMS affected versions not specified Description: The issue is related to the implementation of the subscribes delete confirm method in the comments module of the Netcat CMS system, which fails to take measures to protect the SQL query...
PT-2024-5669 · Unknown · Netcat Cms
Name of the Vulnerable Software and Affected Versions: Netcat CMS affected versions not specified Description: The issue is related to the implementation of the get component fields method in the comments module of the Netcat CMS system, which fails to take measures to protect the SQL query...
RADIUS Protocol under RFC 2865 安全漏洞
RADIUS Protocol under RFC 2865 is an RFC open source networking protocol. A security vulnerability exists in RADIUS Protocol under RFC 2865, which can be exploited by an attacker to modify any valid response Access-Accept, Access-Reject, or Access-Challenge to any other response using a Choice...