4690 matches found
Exposure of Resource to Wrong Sphere
The Jetpack Carousel module of the JetPack WordPress plugin allows users to create a carousel type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhgvcs that allowed the comments of non-published page/posts to...
PT-2021-15909 · WordPress · Jetpack
Name of the Vulnerable Software and Affected Versions: JetPack WordPress plugin versions prior to 9.8 Description: A security issue was found in the Jetpack Carousel module, which allows users to create image galleries and comment on images. This issue, discovered by nguyenhg vcs, enables the...
PT-2021-15912
Name of the Vulnerable Software and Affected Versions Comments Like Dislike WordPress plugin versions prior to 1.1.4 Description The issue allows any user, including unauthenticated ones, to add unlimited likes or dislikes to any comment by replaying the AJAX request. The plugin's restriction...
WordPress Access Control Vulnerability
WordPress is a set of open source blogging platforms developed using the PHP language by the WordPress Foundation. A replay attack vulnerability exists in the WordPress Comments Like Dislike plugin. An attacker can use this vulnerability to add an unlimited number of like/dislike comments to any...
CVE-2021-24379: Incorrect Authorization
The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user even unauthenticated to add unlimited like/dislike to any comment. The plugin appears to have som...
CVE-2021-33829
A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...
CKEditor cross-site scripting vulnerability
CKEditor is an open source, web-based text editor. CKEditor suffers from a cross-site scripting vulnerability that stems from improper handling of input data in the HTML data processor. A remote attacker can inject executable JavaScript code via a crafted comment. The following products and model...
Comments Like Dislike < 1.1.4 - Add Like/Dislike Bypass
The plugin allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user even unauthenticated to add unlimited like/dislike to any comment. The plugin appears to have some Restriction modes, such as Cookie...
WordPress Comments Like Dislike plugin <= 1.1.3 - Repeated Voting Restriction Bypass vulnerability
Repeated Voting Restriction Bypass vulnerability discovered by Phu Tran in WordPress Comments Like Dislike plugin versions = 1.1.3. Solution Update the WordPress Comments Like Dislike plugin to the latest available version at least 1.1.4...
AIs and Fake Comments
This month, the New York state attorney general issued a report on a scheme by "U.S. Companies and Partisans to Hack Democracy." This wasn’t another attempt by Republicans to make it harder for Black people and urban residents to vote. It was a concerted attack on another core element of US...
WordPress cross-site scripting vulnerabilities
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WP Customer Reviews WordPress plugin before 3.5.6, which can ...
hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used
A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized...
CVE-2021-29044
Cross-site scripting XSS vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary w...
CVE-2020-23689
CVE-2020-23689 affects YFCMF v2.3.1, with a stored cross-site scripting (XSS) vulnerability in the news page comments. The issue is evidenced across multiple sources (NVD entry and Red Hat/OSS references) noting a stored XSS in the comments section. The CVSS data indicates a medium severity (CVSS...
CVE-2020-23689
In YFCMF v2.3.1, there is a stored XSS vulnerability in the comments section of the news page...
YFCMF Cross-Site Scripting Vulnerability
YFCMF is a software application. Provides a lightweight enterprise website management system. A cross-site scripting vulnerability exists in YFCMF version v2.3.1, which originates in the comments section of the news page...
PT-2021-10926
Name of the Vulnerable Software and Affected Versions YFCMF version 2.3.1 Description The issue is related to a stored XSS vulnerability located in the comments section of the news page. Recommendations For YFCMF version 2.3.1, consider disabling the comments section of the news page until a patc...
CVE-2020-23689: Improper Neutralization of Input During Web Page Generation
In YFCMF v2.3.1, there is a stored XSS vulnerability in the comments section of the news page...
Liferay Portal and Liferay DXP cross-site scripting vulnerabilities
Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...
