New York Lawmakers Want Anonymous Comments Banned

A bill before the New York State Assembly would essentially ban anonymous comments on New York-based Web sites. Earlier this week a Wired writer discovered a bill had been introduced this spring in both chambers called the Internet Protection Act. The proposed law would require that a Web site...

persistent xss through svg file attachment download

The fix for CONF-22132 was not sufficient because "svg" files are not "said" to be xml by the isXml method. This means that is possible for a malicious party to upload a svg file containing html/javascript which will be rendered in victim's web browser. This bug should have been raised a while ag...

Facebook Open to Comments on Proposed Privacy Policy Changes

Facebook today announced proposed changes to its privacy policy that may better explain how it uses cookies and how long it retains your data, which is: “as long as necessary.” In addition, it wants the option to use your data for advertising on third-party Web sites. In a message called “Enhanci...

Facebook Anti-Troll System Snagging Ordinary Users

Complaints rang far and wide last week after an automated system for spotting inappropriate Facebook comments began blocking legitimate posts by the social network’s users, including prominent members like Robert Scoble. Facebook users of all stripes have received warnings about posting...

ESHOP network operators treasure Mall 1.0 GetWebshell-vulnerability warning-the black bar safety net

A day Wake up late, get up found on the ground a flyer. See is an online shop. So want to see with what program, find out where to see the html comments,css comments, and file name. Find is ESHOP network operators treasure Mall. google under exploits, found eshop exploits, test the next, not. But...

DEBIAN-CVE-2012-2404

wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors...

CVE-2012-2404

wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors...

Comment matter Wordpress plugin persistent XSS and Key remote arbitrary tampering-bug warning-the black bar safety net

xss /wp-content/plugins/pinglunla/relay. php? sid=ec51555f3e5e125257457a73609bdbe15cb7c29d"/scriptscriptalert0/scriptscript%20src=" The above URL for tampering with comments. SID, while injecting any script, the script will be saved permanently, affecting all of the open comments feature of the...

WordPress <= 3.3.1 - XSS #1

This vulnerability is in the wp-comments-post.php. It allows the attackers to conduct XSS attacks via unspecified vectors. Solution Update WordPress...

PT-2012-4017

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.3.2 Description The issue allows remote attackers to conduct cross-site scripting XSS attacks. This is due to the support of offsite redirects in the wp-comments-post.php file. Recommendations For versions prior t...

CVE-2012-2404: Improper Neutralization of Input During Web Page Generation

wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors...

Plume CMS 1.2.4 - Multiple Persistent Cross-Site Scripting Vulnerabilities

Plume CMS 1.2.4 - Multiple Persistent Cross-Site Scripting Vulnerabilities +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : PlumeCMS = 1.2.4 Multiple Persistent XSS Date : 04-04-2012 Author : Ivano...

Plume CMS 1.2.4 - Multiple Persistent Cross-Site Scripting Vulnerabilities

+--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : PlumeCMS = 1.2.4 Multiple Persistent XSS Date : 04-04-2012 Author : Ivano Binetti http://www.ivanobinetti.com Software link :...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 logindata parameter to admin/auth.php; 2 nb parameter to admin/blogs.php; 3 type, 4 sortby, 5 order, or 6 status parameters to admin/comments.php; or ...

11in1 CMS 1.2.1 - 'admin/comments?topicID' SQL Injection

source: https://www.securityfocus.com/bid/52306/info 11in1 CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the applicatio...

Movable Type vulnerable to session hijacking

Overview Movable Type contains a session hijacking vulnerability. Movable Type contains a session hijacking vulnerability in entering comments and community functionality. Impact A remote unauthenticated attacker may impersonate an honest user of the affected product. Solution Update the software...

Movable Type vulnerable to cross-site request forgery

Overview Movable Type contains a cross-site request forgery vulnerability. Movable Type contains a cross-site request forgery vulnerability in entering comments and community functionality. Impact If a user views a malicious page while logged in, settings may be changed, data may be viewed or...

WordPress Recent Comments Plugin <= 2.0.6 - XSS

Because of this vulnerability in the core.php, the attackers can inject arbitrary web script or HTML via the "page" parameter. Solution Update the plugin...

WordPress Recent Comments Plugin <= 2.0.6 - SQL injection

Because of this vulnerability, the attackers can execute arbitrary SQL commands via the "id" parameter. Solution Update the plugin...

PT-2012-1865

Name of the Vulnerable Software and Affected Versions Symphony CMS versions prior to 2.2.4 Description The issue allows remote authenticated users with Author permissions to execute arbitrary SQL commands via the filter parameter to 1 "symphony/publish/comments" or 2 "symphony/publish/images" API...