Design/Logic Flaw

Algorithmic complexity vulnerability in Address.pm in the Email-Address module 1.908 and earlier for Perl allows remote attackers to cause a denial of service CPU consumption via a crafted string containing a list of e-mail addresses in conjunction with parenthesis characters that can be associat...

CVE-2015-7686

Algorithmic complexity vulnerability in Address.pm in the Email-Address module 1.908 and earlier for Perl allows remote attackers to cause a denial of service CPU consumption via a crafted string containing a list of e-mail addresses in conjunction with parenthesis characters that can be associat...

UBUNTU-CVE-2015-7686

Algorithmic complexity vulnerability in Address.pm in the Email-Address module 1.908 and earlier for Perl allows remote attackers to cause a denial of service CPU consumption via a crafted string containing a list of e-mail addresses in conjunction with parenthesis characters that can be associat...

CVE-2015-7686

Algorithmic complexity vulnerability in Address.pm in the Email-Address module 1.908 and earlier for Perl allows remote attackers to cause a denial of service CPU consumption via a crafted string containing a list of e-mail addresses in conjunction with parenthesis characters that can be associat...

CVE-2015-7686

Algorithmic complexity vulnerability in Address.pm in the Email-Address module 1.908 and earlier for Perl allows remote attackers to cause a denial of service CPU consumption via a crafted string containing a list of e-mail addresses in conjunction with parenthesis characters that can be associat...

CVE-2015-7686: Improper Input Validation

Algorithmic complexity vulnerability in Address.pm in the Email-Address module 1.908 and earlier for Perl allows remote attackers to cause a denial of service CPU consumption via a crafted string containing a list of e-mail addresses in conjunction with parenthesis characters that can be associat...

PT-2015-7580

Name of the Vulnerable Software and Affected Versions Email-Address module versions 1.908 and earlier Description The issue allows remote attackers to cause a denial of service due to high CPU consumption. This can be achieved by sending a crafted string containing a list of e-mail addresses in...

HackerOne: Minor Bug: Public un-compiled CSS with original sass, versioning, source map, comments, etc.

A stylesheet is available in a non-minified, non-compiled format. It includes sass, versioning, a source map, a style guide, comments, etc. see base64 encoded string at the very end of the document. https://hackerone.com/assets/application.css This alone is obviously not an exploit. However, it c...

Livefyre Comments 3 4.1.4 XSS

Every registered user can change livefyresiteid and livefyresitekey. File: livefyre-comments\src\admin\LivefyreAdmin.php function construct $lfcore $this-lfcore = $lfcore; $this-ext = $lfcore-ext; addaction 'adminmenu', array &$this, 'registeradminpage' ; addaction 'adminnotices', array &$this,...

Serendipity cross-site scripting vulnerability (CNVD-2015-06044)

Serendipity is a PHP-based blogging system developed by Serendipity team. The system supports the creation of online journals, blogs, web pages and more. A cross-site scripting vulnerability exists in the js/2k11.min.js file in Serendipity 2.0.1 and prior versions of the 2k11 theme, which stems...

Anchor CMS 0.9.2 Cross Site Scripting / Open Redirect

Anchor CMS 0.9.2: XSS Security Advisory – Curesec Research Team 1. Introduction Affected Product: Anchor CMS 0.9.2 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: Website: http://anchorcms.com/ Vulnerability Type: XSS and Open Redirect Remote Exploitable: Yes Reported to vendor:...

WordPress <= 4.2 - Stored XSS

Confirmed vulnerable: WordPress 4.2, 4.1.2, 4.1.1, 3.9.3. Tested with MySQL versions 5.1.53 and 5.5.41. OverviewCurrent versions of WordPress are vulnerable to a stored XSS. An unauthenticated attacker can inject JavaScript in WordPress comments. The script is triggered when the comment is viewed...

WordPress Subscribe To Comments Reloaded Plugin <= 150611 - XSS

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

digitalartinmotion.com XSS vulnerability

Open Bug Bounty ID: OBB-80028 Description| Value ---|--- Affected Website:| digitalartinmotion.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Zendesk: Stored XSS in comments

Hi , I have found an XSS vulnerability in commenting on articles. Steps to reproduce: 1. Go to an article on your website for example: https://testingthatweb.zendesk.com/hc/en-us/articles/204094081 2. Type this in the comment box: Click here 3. after the comment is posted , you'll see your commen...

spletnik.ru XSS vulnerability

Vulnerable URL: http://www.spletnik.ru/blogs/moda/83086vse-pobeditelnitcy-shou-american-top-model/comments/2?x"...

WordPress plugin Subscribe to Comments 'options-general.php' local file inclusion vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A local file inclusion vulnerability exists in the WordPress plugin Subscribe to Comments 'options-general.php'. Because the...

PT-2015-5665

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.2.4 Description A SQL injection issue exists due to mishandling of comments retrieved from the trash in the wp untrash post comments function. This allows remote attackers to execute arbitrary SQL commands...

wordpress: multiple issues

CVE-2015-2213: SQL injection in comments ID. - CVE-2015-5730: Timing attack in widgets. - CVE-2015-5731: Denial of service by locking a post from being edited. - CVE-2015-5732, CVE-2015-5733 CVE-2015-5734: XSS...

WordPress 3.8.1 / 3.8.2 / 4.2.2 Cross Site Request Forgery

Details ================ Software: WordPress Version: 3.8.1,3.8.2,4.2.2 Homepage: http://wordpress.org/ Advisory report: https://security.dxw.com/advisories/comment-form-csrf-allows-admin-impersonation-via-comments-in-wordpress-4-2-2/ CVE: Awaiting assignment CVSS: 4.3 Medium;...