4663 matches found
Comments Like Dislike < 1.1.4 - Add Like/Dislike Bypass
The plugin allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user even unauthenticated to add unlimited like/dislike to any comment. The plugin appears to have some Restriction modes, such as Cookie...
WordPress Comments Like Dislike plugin <= 1.1.3 - Repeated Voting Restriction Bypass vulnerability
Repeated Voting Restriction Bypass vulnerability discovered by Phu Tran in WordPress Comments Like Dislike plugin versions = 1.1.3. Solution Update the WordPress Comments Like Dislike plugin to the latest available version at least 1.1.4...
AIs and Fake Comments
This month, the New York state attorney general issued a report on a scheme by "U.S. Companies and Partisans to Hack Democracy." This wasn’t another attempt by Republicans to make it harder for Black people and urban residents to vote. It was a concerted attack on another core element of US...
WordPress cross-site scripting vulnerabilities
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WP Customer Reviews WordPress plugin before 3.5.6, which can ...
hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used
A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized...
CVE-2021-29044
Cross-site scripting XSS vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary w...
CVE-2020-23689
CVE-2020-23689 affects YFCMF v2.3.1, with a stored cross-site scripting (XSS) vulnerability in the news page comments. The issue is evidenced across multiple sources (NVD entry and Red Hat/OSS references) noting a stored XSS in the comments section. The CVSS data indicates a medium severity (CVSS...
CVE-2020-23689
In YFCMF v2.3.1, there is a stored XSS vulnerability in the comments section of the news page...
PT-2021-10926
Name of the Vulnerable Software and Affected Versions YFCMF version 2.3.1 Description The issue is related to a stored XSS vulnerability located in the comments section of the news page. Recommendations For YFCMF version 2.3.1, consider disabling the comments section of the news page until a patc...
YFCMF Cross-Site Scripting Vulnerability
YFCMF is a software application. Provides a lightweight enterprise website management system. A cross-site scripting vulnerability exists in YFCMF version v2.3.1, which originates in the comments section of the news page...
CVE-2020-23689: Improper Neutralization of Input During Web Page Generation
In YFCMF v2.3.1, there is a stored XSS vulnerability in the comments section of the news page...
Liferay Portal and Liferay DXP cross-site scripting vulnerabilities
Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...
ISPs Funded 8.5 Million Fake Comments Opposing Net Neutrality
The secret campaign, backed by major broadband companies, used real people’s names without their consent...
80% of Net Neutrality Comments to FCC Were Fudged
Broadband providers and a 19-year-old college student were among those who successfully hijacked public comments during a crucial decision-making process in 2017 to overturn net neutrality by flooding the Federal Communications Commission FCC with fraudulent comments indicating their position on...
Cross-site scripting in phpoffice/phpspreadsheet
This affects the package phpoffice/phpspreadsheet. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as...
GHSA-PVGF-MRR4-CW7R Cross-Site Request Forgery in ForkCMS
Multiple cross-site request forgery CSRF vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to 1 approve the mass of the user's comments, 2 restoring a deleted user, 3 installing or running modules, 4 resetting the...
CVE-2021-24236
The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the request to forbid dangerous files. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type along with a PHP filename...
CVE-2021-30227
Cross Site Scripting XSS vulnerability in the article comments feature in emlog 6.0...
