4670 matches found
PT-2019-8539
Name of the Vulnerable Software and Affected Versions spotim-comments plugin versions prior to 4.0.4 Description The issue concerns multiple XSS problems. Recommendations For versions prior to 4.0.4, update to version 4.0.4 or later to resolve the issue...
CVE-2017-18608: Improper Neutralization of Input During Web Page Generation
The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues...
CVE-2019-7176
An issue was discovered in GitLab Community and Enterprise Edition 8.x starting in 8.9, 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x before 11.7.2. It has Incorrect Access Control. Guest users are able to add reaction emojis on comments to which they have no visibility...
CVE-2019-7176
Removed by vendor...
CVE-2019-6995
An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Users are able to comment on locked project issues...
Authorization
An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a project are able to post comments on confidential issues through an authorization issue in the note endpoint...
PT-2019-12371
Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions prior to 11.8.9 Description The issue is related to Incorrect Access Control, allowing unprivileged members of a project to post comments on confidential issues. This is due to an authorization...
CVE-2019-7176: Undefined Security Weakness
An issue was discovered in GitLab Community and Enterprise Edition 8.x starting in 8.9, 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x before 11.7.2. It has Incorrect Access Control. Guest users are able to add reaction emojis on comments to which they have no visibility...
GhIDA: Ghidra decompiler for IDA Pro
By Andrea Marcelli Executive Summary Cisco Talos is releasing two new tools for IDA Pro: GhIDA and Ghidraaas. GhIDA is an IDA Pro plugin that integrates the Ghidra decompiler in the IDA workflow, giving users the ability to rename and highlight symbols and improved navigation and comments. GhIDA...
WordPress 5.2.2 - Cross-Site Scripting (XSS) in Stored Comments
Description From the WordPress version release notes: "Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues. The first, a cross-site scripting XSS vulnerability found in post previews by contributors. The second was a cross-site scripting vulnerability in stored...
WordPress 5.2.2 - Authenticated Cross-Site Scripting (XSS) in Post Previews
Description From the WordPress version release: "Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues. The first, a cross-site scripting XSS vulnerability found in post previews by contributors. The second was a cross-site scripting vulnerability in stored comments."...
GitLab Information Disclosure Vulnerability (CNVD-2019-30781)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...
PYSEC-2019-174
Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and /login/...
WordPress feature-comments plugin cross-site request forgery vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. feature-comments is a comment management plugin used in it. A cross-site request forgery vulnerability exists in the WordPress...
CVE-2014-10382
The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment...
Cross site request forgery (csrf)
The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment...
CVE-2014-10382
The CVE-2014-10382 vulnerability affects the WordPress feature-comments plugin prior to version 1.2.5. It is a cross‑site request forgery (CSRF) flaw that allows an attacker to perform actions like featuring or burying comments by authenticated/unauthenticated users depending on the context descr...
CVE-2014-10382
The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment...
PT-2019-7058
Name of the Vulnerable Software and Affected Versions feature-comments plugin versions prior to 1.2.5 for WordPress Description The issue concerns a CSRF problem that affects the featuring or burying of comments. Recommendations For versions prior to 1.2.5, update to version 1.2.5 or later to...