3655 matches found
Dotclear cross-site scripting vulnerability (CNVD-2017-01936)
Dotclear is a software developer Olivier Meunier developed a free PHP and MySQL-based blog Blog publishing software. A cross-site scripting vulnerability exists in the admin/comments.php file in versions of Dotclear prior to 2.8.2. This vulnerability can be exploited by a remote attacker to injec...
Cisco Intrusion Prevention System Device Manager Information Disclosure Vulnerability
A vulnerability in the web-based management interface of the Cisco Intrusion Prevention System Device Manager IDM could allow an unauthenticated, remote attacker to view sensitive information stored in certain HTML comments. The vulnerability is due to improper masking of sensitive data in...
UBUNTU-CVE-2015-8831
Cross-site scripting XSS vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the author name in a comment...
CVE-2015-8831
Cross-site scripting XSS vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the author name in a comment...
Service Desk mail handler create comments in other JIRA issues if subject have valid issues keys
h3. Summary Service Desk mail handler create comments in other JIRA issues if email subject have valid issues keys of issues from other JIRA Projects. h3. Environment Cloud h3. Steps to Reproduce Create a SD project Setup the mail handler Create another project and create an issue on it. Send an...
Bet Comments - Pro Bet Tips - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Bet Comments - Pro Bet Tips published at the 'play' market has multiple vulnerabilities...
Multiple Cross-Site Scripting Vulnerabilities in b2evolution
b2evolution is a PHP and MySQL based blogging software developed by software developer FrancoisPlanque. A cross-site scripting vulnerability exists in the file type table of b2evolution versions prior to 6.8.3. The vulnerability can be exploited by remote attackers to inject arbitrary web script ...
CVE-2017-5475
comment.php in Serendipity through 2.0.5 allows CSRF in deleting any comments...
Rockstar Games: Ability to post comments to a crew even after getting kicked out
The researcher found that under certain conditions, Crew members were still able to perform particular actions, such as posting on the Crew wall, even after being kicked from the Crew. Additional verification checks were put in place to prevent this behavior. TL;DR - Members who got kicked out of...
Shopify: Stored XSS in blog comments through Shopify API
Hi there! As far I understand the Shopify Shop have blogs which allow users to comment on blog posts, however the comments with HTML content automatically gets sanitised and then posted to avoid XSS issue. However using the API for comment modification, any application with comment permission can...
openSUSE Security Update : pacemaker (openSUSE-2016-1447)
This update for pacemaker fixes the following issues : - remote: Allow cluster and remote LRM API versions to diverge bsc1009076 - libcrmcommon: fix CVE-2016-7035 improper IPC guarding bsc1007433 - sysconfig: minor tweaks typo, wording - spec: more robust check for systemd being in use - spec:...
Habari CMS 0.9.2 Cross Site Scripting Vulnerability
Habari CMS version 0.9.2 suffers from a cross site scripting vulnerability. Document Title: =============== Habari CMS v0.9.2 - Backend Comments XSS Vulnerability Product & Service Introduction: =============================== While there are a number of technical reasons that highlight the...
Stored Cross-Site Scripting Vulnerability in Pivotx
Pivotx is an open source blog content management system. Pivotx 2.3.11 and prior versions have a stored cross-site scripting vulnerability at the home page message comments. A lack of filtering in the lib.php file allows an attacker to inject cross-site statements using only supported tags...
HackerOne: Partial disclosure of report activity through new "Export as .zip" feature
Hello Team, I noticed a new feature has been launched, which allows to export report. Great feature. But unfortunately it discloses comments of partially disclosed reports which supposed to be hidden.. POC: Go to this partially disclosed report https://hackerone.com/reports/██████████ Click Expor...
Habari CMS v0.9.2 - (Backend Comments) XSS Vulnerability
Document Title: =============== Habari CMS v0.9.2 - Backend Comments XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1999 Release Date: ============= 2016-11-09 Vulnerability Laboratory ID VL-ID: ==================================== 19...
Habari CMS v0.9.2 - (Backend Comments) XSS Vulnerability
Document Title: =============== Habari CMS v0.9.2 - Backend Comments XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1999 Release Date: ============= 2016-11-09 Vulnerability Laboratory ID VL-ID: ==================================== 19...
lolcounter.com XSS vulnerability
Open Bug Bounty ID: OBB-189006 Description| Value ---|--- Affected Website:| lolcounter.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Wordpress contus-video-comments plugin remote file upload vulnerability
WordPress is a suite of blogging platforms developed using the PHP language by the WordPress Software Foundation. contus-video-comments is one of the video comment plugins. A remote file upload vulnerability exists in version v1.0 of the Wordpress contus-video-comments plugin, which can be...
Drupal 8.x < 8.1.10 Multiple Vulnerabilities
The version of Drupal running on the remote web server is 8.x prior to 8.1.10. It is, therefore, affected by multiple vulnerabilities : - A flaw exists due to improper checking for 'Administrator comments' permissions, which allows users who have rights to edit a node to set the visibility for...