3655 matches found
CVE-2017-18215
xvpng.c in xv 3.10a has memory corruption out-of-bounds write when decoding PNG comment fields, leading to crashes or potentially code execution, because it uses an incorrect length value...
CVE-2017-6926
In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the...
CVE-2017-6926
CVE-2017-6926 affects Drupal 8.4.x before 8.4.5 where users with permission to post comments can view content and comments they access to and add comments to that content. The issue’s underlying cause is tied to Drupal’s comment system behavior; mitigations are stated as requiring the comment sys...
Concrete5 < 8.3.0 - Username / Comments Enumeration Exploit
Exploit for php platform in category web applications !/usr/bin/env python3 Concrete5 8.3 vulnerable to Authorization Bypass Through User-Controlled Key IDOR CVE-2017-18195 Chapman R3naissance Schleiss from queue import Queue from threading import Thread from bs4 import BeautifulSoup from tabulat...
Concrete5 Username / Comments Enumeration
!/usr/bin/env python3 Concrete5 8.3 vulnerable to Authorization Bypass Through User-Controlled Key IDOR CVE-2017-18195 Chapman R3naissance Schleiss from queue import Queue from threading import Thread from bs4 import BeautifulSoup from tabulate import tabulate import argparse import requests impo...
Concrete5 CMS < 8.3.0 - Username / Comments Enumeration
!/usr/bin/env python3 Concrete5 8.3 vulnerable to Authorization Bypass Through User-Controlled Key IDOR CVE-2017-18195 Chapman R3naissance Schleiss from queue import Queue from threading import Thread from bs4 import BeautifulSoup from tabulate import tabulate import argparse import requests impo...
Concrete5 Comments on Enumeration Vulnerability
concrete5 is an open source content management system CMS for publishing content on the World Wide Web and intranet. A comment enumeration vulnerability exists in tools/conversations/viewajax.php in Concrete5 before 8.3.0. An unauthenticated user can exploit this vulnerability by posting a reques...
Design/Logic Flaw
An issue was discovered in tools/conversations/viewajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/viewajax with incremental 'cnvID' integers...
CVE-2017-18195
An issue was discovered in tools/conversations/viewajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/viewajax with incremental 'cnvID' integers...
CVE-2017-18195
Concrete5
CVE-2017-18095
The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 the fixed version 4.5.x and before 4.6.0 allows remote attackers to comment on snippets they do not have authorization to access via an improper authorization vulnerability...
Cross site scripting
The print snippet resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a comment on the snippet...
CVE-2018-7197
An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting XSS vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL...
CVE-2018-7197
An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting XSS vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL...
Design/Logic Flaw
Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & receive notifications when comments are added to the watched page, and vote & watch JIRA issues that they do not have access to, although th...
Skybox Platform Cross-Site Scripting Vulnerability
Skybox PlatformAn enterprise-grade network security management platform from US-based Skybox Security. The platform features attack vector analysis, firewall management, vulnerability and threat management, and more. A cross-site scripting vulnerability exists in the title, Comments, or Descripti...
booksonline.com.ua XSS vulnerability
Open Bug Bounty ID: OBB-519929 Description| Value ---|--- Affected Website:| booksonline.com.ua Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Vanilla Forums Cross Site Request Forgery
Exploit Title: CSRF vulnerabilities in Vanilla Forums below 2.1.5-CVE-2017-1000432 Google Dork: NA Date: 7/1/2018 Contact: https://twitter.com/anandm47 website: https://anandtechzone.blogspot.in Exploit Author: Anand Meyyappan Vendor Homepage: https://open.vanillaforums.com Software Link:...
Vanilla 2.1.5 - Cross-Site Request Forgery
Vanilla 2.1.5 - Cross-Site Request Forgery Exploit Title: CSRF vulnerabilities in Vanilla Forums below 2.1.5-CVE-2017-1000432 Google Dork: NA Date: 7/1/2018 Contact: https://twitter.com/anandm47 website: https://anandtechzone.blogspot.in Exploit Author: Anand Meyyappan Vendor Homepage:...