WordPress spotim-comments plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. spotim-comments is a user interaction plugin used in it, which includes features such as real-time comments, online chat, and...

CVE-2019-15734

An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, commit titles and team member comments could become viewable to users who did not have permission to access these...

CVE-2019-15731

CVE-2019-15731 affects GitLab Community and Enterprise Edition 12.0–12.2.1. The issue allows non-members to comment on merge requests even when the repository is configured to permit comments only from project members. Root cause details are not explicitly provided in the connected documents beyo...

CVE-2019-15734: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, commit titles and team member comments could become viewable to users who did not have permission to access these...

PT-2019-14356

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.6 through 12.2.1 Description An issue was discovered where commit titles and team member comments could become viewable to users who did not have permission to access these under very specific...

Atlassian Jira WikiRenderer parser XSS vulnerability

Summary An exploitable XSS vulnerability exists in the WikiRenderer functionality of Atlassian Jira, from version 7.6.4 to 8.1.0. A specially crafted comment can cause a persistent XSS. An attacker can create a comment or worklog entry to trigger this vulnerability. Tested Versions Atlassian Jira...

Cross-site Scripting (XSS)

wordpress is vulnerable to cross-site scripting XSS. The attack is due to not having a proper handling of the stored comments...

CVE-2019-16218

WordPress before 5.2.3 allows XSS in stored comments...

CVE-2019-16218

WordPress before 5.2.3 allows XSS in stored comments...

CVE-2019-16218

WordPress before 5.2.3 allows XSS in stored comments...

UBUNTU-CVE-2019-16218

WordPress before 5.2.3 allows XSS in stored comments...

Cross site scripting

WordPress before 5.2.3 allows XSS in stored comments...

CVE-2019-16218

WordPress before 5.2.3 allows XSS in stored comments...

CVE-2019-16218

CVE-2019-16218 affects WordPress prior to 5.2.3, where stored comments can trigger XSS. Root cause is an input handling flaw in comments that allows script injection. The issue is documented in the CVE entry as WordPress before 5.2.3 allows XSS in stored comments. Public references indicate WordP...

CVE-2019-16218

WordPress before 5.2.3 allows XSS in stored comments...

CVE-2019-16218

WordPress before 5.2.3 allows XSS in stored comments...

Code injection

Libra Core before 2019-09-03 has an erroneous regular expression for inline comments, which makes it easier for attackers to interfere with code auditing by using a nonstandard line-break character for a comment. For example, a Move module author can enter the // sequence which introduces a...

CVE-2019-16214

CVE-2019-16214 affects Libra Core prior to 2019-09-03, where an erroneous regular expression for inline comments lets a nonstandard line-break character (\r) appear to terminate a comment in audits, potentially misleading readers about code execution. The Move module author could place // followe...

PT-2019-5208 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.3 Description: The issue is related to an error in handling stored comments, allowing for XSS attacks. This could potentially enable a remote attacker to impact data integrity. Recommendations: For WordPress...

PT-2019-14584

Name of the Vulnerable Software and Affected Versions Libra Core versions prior to 2019-09-03 Description The issue arises from an erroneous regular expression for inline comments, making it easier for attackers to interfere with code auditing. This can be achieved by using a nonstandard line-bre...