4670 matches found
CVE-2022-22791
SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system...
Design/Logic Flaw
SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system...
CVE-2022-22791 SYNEL - eharmony Authenticated Blind & Stored XSS
SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system...
YzmCMS security vulnerabilities
Yzmcms is an open source CMS content management system for Yzmcms individual developers. an uncontrolled recursive vulnerability exists in YzmCMS v6.3, which stems from the fact that the comment function can operate concurrently and an attacker can use this vulnerability to create an unusually...
Synel Eharmonynew Cross-site Scripting Vulnerability
Synel Eharmonynew is an attendance system from Synel Israel. Synel Eharmonynew suffers from a cross-site scripting vulnerability that allows an attacker to inject JS code into the comments field and could lead to potential cookie theft, HTML markup, and JS code being loaded into the system...
PT-2022-15680
Name of the Vulnerable Software and Affected Versions SYNEL - eharmony affected versions not specified Description The issue allows an attacker to inject JS code into the comments field, potentially leading to the stealing of cookies and the loading of HTML tags and JS code onto the system. This ...
CVE-2022-22791: Improper Neutralization of Input During Web Page Generation
SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system...
Incorrect Notifications
wagtail is sending notifications incorrectly. All users who left a comment or reply somewhere on the site are getting the notifications for a new replies in comment threads replied or commented on pages by another user because it fails to restrict notifications for new replies to the participants...
PYSEC-2022-13
Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that ...
CVE-2022-21683 Comment reply notifications sent to incorrect users in wagtail
Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that ...
CVE-2021-44217
In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting XSS vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API...
PYSEC-2022-43181
In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting XSS vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API...
PYSEC-2022-43181
In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting XSS vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API...
Android-Gif-Drawable input validation error vulnerability
Android-Gif-Drawable is Views and Drawable for displaying animated Gifs on Android. An input validation error vulnerability exists in android-gif-drawable that stems from the product's decode.c file not limiting the length of comments. This vulnerability can be exploited to cause a denial of...
PT-2022-12020
Name of the Vulnerable Software and Affected Versions Ericsson CodeChecker versions prior to 6.18.2 Description A Stored Cross-site scripting XSS vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of...
Pipenv's requirements.txt parsing allows malicious index url in comments
Issue Summary Due to a flaw in pipenv's parsing of requirements files, an attacker can insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file e.g. with "pipenv install -r requirements.txt...
Improper Access Control in chocobozzz/peertube
Description Unauthenticated users can obtain comments on private videos Proof of Concept Vísit the following API link where 123 is the ID of the private video: /api/v1/videos/123/comment-threads Response contains all the comments on that private video. Impact This vulnerability disclosure comment...
Attackers Exploit Flaw in Google Docs’ Comments Feature
Attackers are using the “Comments” feature of Google Docs to send malicious links in a phishing campaign targeted primarily at Outlook users, researchers have discovered. Researchers from email collaboration and security firm Avanan, a CheckPoint company, first observed “a new, massive wave of...
Design/Logic Flaw
The Stars Rating WordPress plugin before 3.5.1 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the comments section, or pending comment dashboard depending if the user sent it as unauthenticated or authenticated...
CVE-2021-24893 Stars Rating < 3.5.1 - Comments Denial of Service
The Stars Rating WordPress plugin before 3.5.1 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the comments section, or pending comment dashboard depending if the user sent it as unauthenticated or authenticated...