4664 matches found
PT-2020-13741
Name of the Vulnerable Software and Affected Versions Craft CMS Comments plugin versions prior to 1.5.5 Description An issue affects comment integrity due to CSRF. Recommendations For versions prior to 1.5.5, update to version 1.5.5 or later to resolve the issue...
CVE-2020-13870: Improper Neutralization of Input During Web Page Generation
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name...
PT-2020-13743
Name of the Vulnerable Software and Affected Versions Craft CMS Comments plugin versions prior to 1.5.5 Description A stored XSS issue was discovered via an asset volume name. Recommendations For versions prior to 1.5.5, update to version 1.5.5 or later to resolve the issue...
CVE-2020-13868: Cross-Site Request Forgery (CSRF)
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity...
PT-2020-13742
Name of the Vulnerable Software and Affected Versions Comments plugin for Craft CMS versions prior to 1.5.6 Description The issue is related to stored XSS via a guest name. This allows for malicious code to be stored and executed when a user interacts with the affected component. Recommendations...
CVE-2020-13869: Improper Neutralization of Input During Web Page Generation
An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name...
hibernate-validator: safeHTML validator allows XSS
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack...
hibernate-validator: safeHTML validator allows XSS
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack...
Cross-Site Scripting (XSS)
ssddanbrown/bookstack is vulnerable to cross-site scripting XSS. Lack of validation and sanitization allows a remote attacker to inject and execute arbitrary Javascript in a user's browser via the comments...
Cross-Site Scripting in BookStack
Impact A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machine...
GHSA-5VF7-Q87H-PG6W Cross-Site Scripting in BookStack
Impact A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machine...
WordPress Content Management System Data Compromise
The vulnerability of the WordPress content management system is related to an error in the reproduction of XSS attacks in comments. Exploiting this vulnerability could allow a malicious actor to compromise data integrity...
UBUNTU-CVE-2020-11036
In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content "alert1" reproduces the attack. This can be exploited by a user with administrator privileges i...
Pegasystem PEGA Platform Cross-Site Scripting Vulnerability (CNVD-2020-27232)
Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem UK. The platform is used to develop applications for BPM Business Process Management, Case Management, Real Time Decision Making and CRM Customer Relationship Management. A cross-site scripting vulnerability...
CVE-2020-12472
MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description...
CVE-2020-12472
MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description...
Cross site scripting
MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description...
CVE-2020-12472
MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description...
PT-2020-13132
Name of the Vulnerable Software and Affected Versions MonoX versions 5.1.40.5152 and earlier Description The issue allows stored XSS via User Status, Blog Comments, or Blog Description. This can lead to malicious script execution when a user views the affected content. Recommendations For MonoX...