4668 matches found
Cross site scripting
MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description...
CVE-2020-12472
MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description...
PT-2020-13132
Name of the Vulnerable Software and Affected Versions MonoX versions 5.1.40.5152 and earlier Description The issue allows stored XSS via User Status, Blog Comments, or Blog Description. This can lead to malicious script execution when a user views the affected content. Recommendations For MonoX...
CVE-2020-12472: Improper Neutralization of Input During Web Page Generation
MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description...
RGhost: Idor on the DELETE /comments/
Summary: Idor on /comments Steps To Reproduce: Make sure you have 2 different ID's to maintain 2 different session for ensurity 1. The request can be tamper with the ID of different comment both the functions of edit/delete can be used 2. Delete gets hampered with the Captcha which is thrown but...
EquationExploit
Based on the provided code, it appears to be a Windows executable file likely a PE file that contains a malicious payload. The code is written in C and is designed to be compiled and executed on a Windows system. The code is a PE file, which is a type of executable file used on Windows systems. T...
Mail.ru: Cross-Site Request Forgery (CSRF) in my.games API
CSRF vulnerability allowed to add/delete/edit store.my.games comments...
Mail.ru: XSS in [community.my.games]
Crossite scripting in community.my.games via post comments All we say is Thank You for an Account Takeover Flaw!...
CVE-2020-10975
GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page...
CVE-2020-10975
GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page...
CVE-2020-10975
GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page...
Libidn2 RFC3490 Domain Creation
The vulnerability of component RFC3490 of the Libidn2 library exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to create a malicious domain that corresponds to the target domain...
[SECURITY] Fedora 30 Update: python3-typed_ast-1.4.0-2.fc30
A fork of the ast module with type annotations. This package is based on th e ast modules from Python 2 and 3, and has been extended with support for type comments and type annotations as supported in Python 3.6...
Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-18328)
Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A stored cross-site scripting vulnerability exists in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9. An attack...
Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-18339)
Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflective cross-site scripting vulnerability exists in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9. The...
Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-17359)
Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflected cross-site scripting vulnerability exists in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language version 9...
CVE-2020-10502
CSRF in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to approve any comment, given the id, via a crafted request...
CVE-2020-10503
CSRF in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to disapprove any comment, given the id, via a crafted request...
