4646 matches found
CVE-2022-43492
Auth. subscriber+ Insecure Direct Object References IDOR vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress...
Spoofing
Auth. subscriber+ Insecure Direct Object References IDOR vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress...
CVE-2022-43492
CVE-2022-43492 affects WordPress with the wpDiscuz plugin at version 7.4.2. It is an Insecure Direct Object References (IDOR) in the Comments feature. The NVD entry lists CVSS v3.1 base metrics: 8.8 (High) with NEURAL: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; PatchStack cites a lower impact vector. R...
PT-2022-26943
Name of the Vulnerable Software and Affected Versions wpDiscuz plugin version 7.4.2 Description The issue is related to an Insecure Direct Object References IDOR vulnerability in the Comments section of the wpDiscuz plugin on WordPress, which requires authentication with subscriber or higher...
CVE-2022-43492: Authorization Bypass Through User-Controlled Key
Auth. subscriber+ Insecure Direct Object References IDOR vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress...
CVE-2022-42000
Cross-site Scripting XSS vulnerability in BlueSpiceSocialProfile extension of BlueSpice allows user with comment permissions to inject arbitrary HTML into the comment section of a wikipage...
PT-2022-26205 · Unknown +1 · Bluespicesocialprofile +1
Name of the Vulnerable Software and Affected Versions: BlueSpice affected versions not specified Description: The issue allows a user with comment permissions to inject arbitrary HTML into the comment section of a wikipage, which can lead to Cross-site Scripting XSS. This occurs in the...
Upgraded Q -> M from #323 [1668467355303]
Judge has assessed an item in Issue 323 as M risk. The relevant finding follows: L00: beforeTokenTransfer function called with wrong params in LBToken Line 237 seems to be a copy pasta mistake from line 209 in LBToken.sol. On line 237 when burning tokens, to should be zero, and amount of from's...
WordPress Add Comments plugin <= 1.0.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
Auth. Stored Cross-Site Scripting XSS vulnerability discovered by roguethread in WordPress Add Comments plugin versions = 1.0.1. Solution Deactivate and delete. This plugin has been closed as of November 9, 2022 and is not available for download. This closure is temporary, pending a full review...
Saibamen HotelManager 跨站脚本漏洞
Saibamen HotelManager is a web application for managing hotels written in Laravel by the individual developer Saibamen. A security vulnerability exists in Saibamen HotelManager v1.2, which stems from improper sanitization of its comment and contact fields, allowing an attacker to implement...
CVE-2022-41435
OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting XSS vulnerability in the component /system/sshkeys.js. This vulnerability allows attackers to execute arbitrary web scripts or HTML via crafted public key comments...
CVE-2022-41435: Improper Neutralization of Input During Web Page Generation
OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting XSS vulnerability in the component /system/sshkeys.js. This vulnerability allows attackers to execute arbitrary web scripts or HTML via crafted public key comments...
CVE-2022-39017
Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-site scripting attacks via specially crafted comments...
CVE-2022-39017: Improper Input Validation
Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-site scripting attacks via specially crafted comments...
GitLab 安全漏洞
GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A security vulnerability exists in GitLab CE/EE versions 15.0 through 15.2.5,...
Cross-Site Scripting (XSS)
feehi/feehicms is vulnerable to cross-site scripting. The vulnerability exists when sending picture comments in single page module which allows an attacker to inject and execute arbitrary javascript via a crafted payload...
PT-2022-5792 · Dropbear +3 · Dropbear +3
Name of the Vulnerable Software and Affected Versions: OpenWrt LuCI version git-22.140.66206-02913be Description: The issue is related to a stored cross-site scripting XSS vulnerability in the /system/sshkeys.js component. This vulnerability allows attackers to execute arbitrary web scripts or HT...
User can get details of the comments that were deleted
Description When a user creates a new record he can add a comment on it. The user is also able to delete the comments after which the user wont be having access to that comment like replying, checking what the comment was. This vulnerability allows any user to see what the deleted comment was and...
Cross-Site Scripting (XSS)
typo3/cms and typo3/html-sanitizer are vulnerable to cross-site scripting. The vulnerability exists due to the vulnerable typo3/html-sanitize dependency used in composer.json, which does not properly sanitize sequences with special HTML comments, allowing an attacker to inject and execute malicio...
