PT-2024-29454

Name of the Vulnerable Software and Affected Versions ProcessWire version 3.0.229 Description A Cross Site Request Forgery issue allows a remote attacker to execute arbitrary code via a crafted HTML file to the comments functionality. Recommendations For version 3.0.229, update to a newer version...

PT-2024-28353

Name of the Vulnerable Software and Affected Versions janeczku Calibre-Web versions 0.6.0 through 0.6.21 Description The issue arises from improper sanitization performed by the clean string function, specifically in the way it handles HTML sanitization, making the edit book comments function...

PT-2024-5669 · Unknown · Netcat Cms

Name of the Vulnerable Software and Affected Versions: Netcat CMS affected versions not specified Description: The issue is related to the implementation of the get component fields method in the comments module of the Netcat CMS system, which fails to take measures to protect the SQL query...

PT-2024-5690 · Unknown · Netcat Cms

Name of the Vulnerable Software and Affected Versions: Netcat CMS affected versions not specified Description: The issue is related to the implementation of the subscribes delete confirm method in the comments module of the Netcat CMS system, which fails to take measures to protect the SQL query...

PT-2024-5689

Name of the Vulnerable Software and Affected Versions Netcat CMS affected versions not specified Description The issue is related to the implementation of the deleteComment method in the comments module of the Netcat CMS system, which fails to take measures to protect the SQL query structure. Thi...

PT-2024-5691

Name of the Vulnerable Software and Affected Versions Netcat CMS affected versions not specified Description The issue exists due to insufficient protection of the web page structure in the comments module of the Netcat CMS system. This allows a remote attacker to execute arbitrary JavaScript cod...

RADIUS Protocol under RFC 2865 安全漏洞

RADIUS Protocol under RFC 2865 is an RFC open source networking protocol. A security vulnerability exists in RADIUS Protocol under RFC 2865, which can be exploited by an attacker to modify any valid response Access-Accept, Access-Reject, or Access-Challenge to any other response using a Choice...

CVE-2024-34481

drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page...

CVE-2024-34481

drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page...

CVE-2024-34481: Improper Neutralization of Input During Web Page Generation

drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page...

CVE-2024-34481

drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page...

Drupal Wiki Security Vulnerabilities

Drupal Wiki is a free and open source content management system from Drupal Wiki, Inc. A security vulnerability exists in Drupal Wiki versions prior to 8.31.1, which stems from allowing cross-site scripting XSS attacks via comments, titles, and image captions on Wiki pages...

CVE-2024-34481

drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page...

CVE-2024-34481

CVE-2024-34481 affects Drupal Wiki prior to 8.31.1 and is described as allowing cross-site scripting (XSS) via comments, captions, and image titles on a Wiki page. The connected sources (Red Hat, Ubuntu, OSV, CVE listings) consistently report the same description. The root cause details are not e...

CVE-2024-34481

drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page...

cJSON before 1.7.11 allows out-of-bounds access related to multiline comments.

...

golang: net/mail: comments in display names are incorrectly handled

A flaw was found in Go's net/mail standard library package. The ParseAddressList function incorrectly handles comments text within parentheses within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions made by programs using...

CVE-2024-38527

CVE-2024-38527 affects ZenUML, a JavaScript-based diagram tool that renders Markdown-inspired diagram definitions. The vulnerability arises from unsanitized Markdown comments in the ZenUML diagram syntax, allowing attacker-controlled comments to trigger Cross-site Scripting (XSS) when diagrams ar...

CVE-2024-38527

ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diagrams. Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting XSS. The comment feature allows the use...

de.wellnerbou.jenkins:git-changelog (>=3.0, <=3.31), org.jenkins-ci.plugins.workflow:puppet-enterprise-pipeline (>=1.2.1, <=1.3.1) +5 more potentially affected by CVE-2024-39459 via org.jenkins-ci.plugins:plain-credentials (1.2)

org.jenkins-ci.plugins:plain-credentials MAVEN version 1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:plain-credentials and may be impacted: - de.wellnerbou.jenkins:git-changelog =3.0, =1.2.1, =1.0.0, =1.58, =1.18, =1.0,...