CVE-2019-16218: Improper Neutralization of Input During Web Page Generation

WordPress before 5.2.3 allows XSS in stored comments...

CVE-2017-18608

The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues...

Cross site scripting

The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues...

CVE-2017-18608

The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues...

CVE-2017-18608

The CVE-2017-18608 entries describe multiple cross-site scripting (XSS) flaws in the Spot.im / spotim-comments WordPress plugin prior to version 4.0.4. Several connected advisories (Red Hat, CNVD, CVE records, and WPVulnDB) corroborate that the vulnerability affects the WordPress plugin as used i...

GitLab CE/EE Information Disclosure Vulnerability (CNVD-2019-32224)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. GitLab CE/...

CVE-2017-18608: Improper Neutralization of Input During Web Page Generation

The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues...

PT-2019-8539

Name of the Vulnerable Software and Affected Versions spotim-comments plugin versions prior to 4.0.4 Description The issue concerns multiple XSS problems. Recommendations For versions prior to 4.0.4, update to version 4.0.4 or later to resolve the issue...

CVE-2019-7176

An issue was discovered in GitLab Community and Enterprise Edition 8.x starting in 8.9, 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x before 11.7.2. It has Incorrect Access Control. Guest users are able to add reaction emojis on comments to which they have no visibility...

CVE-2019-7176

Removed by vendor...

CVE-2019-6995

An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Users are able to comment on locked project issues...

Authorization

An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a project are able to post comments on confidential issues through an authorization issue in the note endpoint...

PT-2019-12371

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions prior to 11.8.9 Description The issue is related to Incorrect Access Control, allowing unprivileged members of a project to post comments on confidential issues. This is due to an authorization...

CVE-2019-7176: Undefined Security Weakness

An issue was discovered in GitLab Community and Enterprise Edition 8.x starting in 8.9, 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x before 11.7.2. It has Incorrect Access Control. Guest users are able to add reaction emojis on comments to which they have no visibility...

GhIDA: Ghidra decompiler for IDA Pro

By Andrea Marcelli Executive Summary Cisco Talos is releasing two new tools for IDA Pro: GhIDA and Ghidraaas. GhIDA is an IDA Pro plugin that integrates the Ghidra decompiler in the IDA workflow, giving users the ability to rename and highlight symbols and improved navigation and comments. GhIDA...

WordPress 5.2.2 - Cross-Site Scripting (XSS) in Stored Comments

Description From the WordPress version release notes: "Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues. The first, a cross-site scripting XSS vulnerability found in post previews by contributors. The second was a cross-site scripting vulnerability in stored...

WordPress 5.2.2 - Authenticated Cross-Site Scripting (XSS) in Post Previews

Description From the WordPress version release: "Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues. The first, a cross-site scripting XSS vulnerability found in post previews by contributors. The second was a cross-site scripting vulnerability in stored comments."...

GitLab Information Disclosure Vulnerability (CNVD-2019-30781)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...

PYSEC-2019-174

Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and /login/...

WordPress feature-comments plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. feature-comments is a comment management plugin used in it. A cross-site request forgery vulnerability exists in the WordPress...