CVE-2018-11526

The plugin "WordPress Comments Import & Export" for WordPress v2.0.4 and before is vulnerable to CSV Injection...

CVE-2018-12104

Cross-site scripting XSS vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/newreport.kp URI...

CVE-2018-12104

Cross-site scripting XSS vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/newreport.kp URI...

PYSEC-2018-116

Cross-site scripting XSS vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/newreport.kp URI...

PYSEC-2018-116

Cross-site scripting XSS vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/newreport.kp URI...

Cross site scripting

Cross-site scripting XSS vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/newreport.kp URI...

CVE-2018-12104

Cross-site scripting XSS vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/newreport.kp URI...

CVE-2018-12104

Airbnb Knowledge Repo 0.7.4 is reported vulnerable to Cross-site Scripting (XSS) via the post comments functionality (post/posts/new_report.kp). The root cause is improper input validation in the comments feature, as cited by Veracode (improper user input validation) and OSV entries noting the is...

Security Bulletin: Security Bulletin: IBM Security Privileged Identity Manager is affected by sensitive information in page comments vulnerability (CVE-2017-1705)

Summary IBM Security Privileged Identity Manager has addressed the following vulnerability. There was left-over sensitive information in page comments Vulnerability Details Relevant CVE Information: CVEID: CVE-2017-1705 DESCRIPTION: IBM Security Privileged Identity Manager contains left-over,...

Shopify - (Comments) Cross Site Scripting Vulnerability

Document Title: =============== Shopify - Comments Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1551 Release Date: ============= 2018-06-14 Vulnerability Laboratory ID VL-ID: ==================================== 1551...

Shopify - (Comments) Cross Site Scripting Vulnerability

Document Title: =============== Shopify - Comments Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1551 Release Date: ============= 2018-06-13 Vulnerability Laboratory ID VL-ID: ==================================== 1551...

CVE-2018-5241

Symantec Advanced Secure Gateway ASG 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability. The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing SAML responses, A...

Authentication flaw

Symantec Advanced Secure Gateway ASG 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability. The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing SAML responses, A...

CVE-2018-5241

Symantec Advanced Secure Gateway ASG 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability. The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing SAML responses, A...

CVE-2018-5241

Symantec Advanced Secure Gateway ASG 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability. The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing SAML responses, A...

Valve: Deleting other people's comments on ModeratorMessages

Due to a missing permissions check, anyone could delete a comment on a community moderator message knowing the unique comment GID and the SteamID of the message receiver. The endpoint has been corrected to verify the correct permissions. You were able to delete others people's comments on moderat...

Frappe ERPNext Cross-Site Scripting Vulnerability

Frappe ERPNext is an open source ERP Enterprise Resource Planning system. The system includes functions for financial management, inventory management, customer relationship management, project management and human resource management. A cross-site scripting vulnerability exists in Frappe ERPNext...

SQL Injection Vulnerability in Cloud EC E-commerce System at Front-end User Comments

Cloud EC e-commerce system hereinafter referred to as Cloud EC is a set of PHP + MYSQL-based open source e-commerce system software developed independently by Cloud MYSQL e-commerce Co. Cloud EC e-commerce system SQL injection vulnerability exists in the front-end user comments. Attackers can use...

WordPress Web-Dorado Instagram Feed WD plugin cross-site scripting vulnerability (CNVD-2018-08291)

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.Web-Dorado Instagram Feed WD plugin is a social media content sharing plugin used in ... A cross-site scripting...

Catfish CMS Cross-Site Scripting Vulnerability

Catfish CMS is an open source content management system CMS written in PHP. A cross-site scripting vulnerability exists in comments in Catfish CMS version 4.7.21. A remote attacker can exploit this vulnerability by sending the 'pinglun' parameter to cat/index/index/pinglun to inject arbitrary web...