CVE-2012-3473

The CVE concerns Ushahidi Platform prior to version 2.5 where the (1) reports API and (2) the admin feature of the comments API do not require authentication, allowing unauthenticated remote manipulation via API functions (generate reports and organize comments). Root cause: endpoints expose thes...

CVE-2012-3473: Improper Authentication

The 1 reports API and 2 administration feature in the comments API in the Ushahidi Platform before 2.5 do not require authentication, which allows remote attackers to generate reports and organize comments via API functions...

PT-2012-4742

Name of the Vulnerable Software and Affected Versions Ushahidi Platform versions prior to 2.5 Description The issue concerns the Ushahidi Platform, where the reports API and administration feature in the comments API do not require authentication. This allows remote attackers to generate reports...

CVE-2012-3474: Exposure of Sensitive Information to an Unauthorized Actor

The comments API in application/libraries/api/MYCommentsApiObject.php in the Ushahidi Platform before 2.5 allows remote attackers to obtain sensitive information about the e-mail address, IP address, and other attributes of the author of a comment via an API function call...

PT-2012-4743

Name of the Vulnerable Software and Affected Versions Ushahidi Platform versions prior to 2.5 Description The issue allows remote attackers to obtain sensitive information about the e-mail address, IP address, and other attributes of the author of a comment via an API function call in the comment...

PT-2012-5186

Name of the Vulnerable Software and Affected Versions RSGallery2 com rsgallery2 component versions prior to 2.3.0 for Joomla! 1.5.x RSGallery2 com rsgallery2 component versions prior to 3.2.0 for Joomla! 2.5.x Description A cross-site scripting XSS issue exists in the comments module, allowing...

CVE-2012-4071: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the comments module in the RSGallery2 comrsgallery2 component before 2.3.0 for Joomla! 1.5.x, and before 3.2.0 for Joomla! 2.5.x, allows remote attackers to inject arbitrary web script or HTML via crafted BBCode markup in a comment...

Persistent xss flaw in the revision history (of comments).

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-47387. panel Whilst a comment is html encoded /sanitized when displayed within an answer to a question the revision history page...

iauto mobile Application 2012 - Multiple Vulnerabilities

Title: ====== iAuto Mobile Application 2012 - Multiple Web Vulnerabilities Date: ===== 2012-07-11 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=658 VL-ID: ===== 658 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: ===========...

Worksforweb iAuto - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/54812/info Worksforweb iAuto is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the contex...

Worksforweb iAuto - Multiple Cross-Site Scripting HTML Injection Vulnerabilities

Worksforweb iAuto - Multiple Cross-Site Scripting HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/54812/info Worksforweb iAuto is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Successfu...

CVE-2011-4292

Moodle 2.0.x before 2.0.3 allows remote authenticated users to cause a denial of service invalid database records via a series of crafted comments operations...

Code injection

Moodle 2.0.x before 2.0.3 allows remote authenticated users to cause a denial of service invalid database records via a series of crafted comments operations...

CVE-2011-4292

Moodle 2.0.x before 2.0.3 allows remote authenticated users to cause a denial of service invalid database records via a series of crafted comments operations...

CVE-2011-4292

Moodle 2.0.x before 2.0.3 allows remote authenticated users to cause a denial of service invalid database records via a series of crafted comments operations...

PT-2012-1840

Name of the Vulnerable Software and Affected Versions Moodle versions 2.0.0 through 2.0.2 Description The issue allows remote authenticated users to cause a denial of service by creating invalid database records through a series of crafted comments operations. Recommendations For Moodle versions...

VamCart CMS 0.9 - Multiple Vulnerabilities

VamCart CMS 0.9 - Multiple Vulnerabilities Title: ====== VamCart v0.9 CMS - Multiple Web Vulnerabilities Date: ===== 2012-06-25 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=622 VL-ID: ===== 622 Common Vulnerability Scoring System: ====================================...

CVE-2011-4292: Improper Neutralization of Special Elements used in an SQL Command

Moodle 2.0.x before 2.0.3 allows remote authenticated users to cause a denial of service invalid database records via a series of crafted comments operations...

Cross site scripting

Cross-site scripting XSS vulnerability in mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to inject arbitrary web script or HTML via a wiki comment...

CVE-2011-4957

The makeclickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the PCRE library, which allows remote attackers to cause a denial of service crash via a comment with a crafted URL that triggers many recursive calls...