CVE-2018-5241

Symantec Advanced Secure Gateway ASG 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability. The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing SAML responses, A...

CVE-2018-5241: Undefined Security Weakness

Symantec Advanced Secure Gateway ASG 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability. The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing SAML responses, A...

Valve: Deleting other people's comments on ModeratorMessages

Due to a missing permissions check, anyone could delete a comment on a community moderator message knowing the unique comment GID and the SteamID of the message receiver. The endpoint has been corrected to verify the correct permissions. You were able to delete others people's comments on moderat...

Frappe ERPNext Cross-Site Scripting Vulnerability

Frappe ERPNext is an open source ERP Enterprise Resource Planning system. The system includes functions for financial management, inventory management, customer relationship management, project management and human resource management. A cross-site scripting vulnerability exists in Frappe ERPNext...

SQL Injection Vulnerability in Cloud EC E-commerce System at Front-end User Comments

Cloud EC e-commerce system hereinafter referred to as Cloud EC is a set of PHP + MYSQL-based open source e-commerce system software developed independently by Cloud MYSQL e-commerce Co. Cloud EC e-commerce system SQL injection vulnerability exists in the front-end user comments. Attackers can use...

WordPress Web-Dorado Instagram Feed WD plugin cross-site scripting vulnerability (CNVD-2018-08291)

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.Web-Dorado Instagram Feed WD plugin is a social media content sharing plugin used in ... A cross-site scripting...

PT-2018-2466

Name of the Vulnerable Software and Affected Versions Web-Dorado Instagram Feed WD plugin versions prior to 1.3.1 Description The issue is related to a lack of protection against web page structure manipulation. It allows a remote attacker to inject arbitrary web scripts or HTML code by passing...

Catfish CMS Cross-Site Scripting Vulnerability

Catfish CMS is an open source content management system CMS written in PHP. A cross-site scripting vulnerability exists in comments in Catfish CMS version 4.7.21. A remote attacker can exploit this vulnerability by sending the 'pinglun' parameter to cat/index/index/pinglun to inject arbitrary web...

CVE-2018-10023

Catfish CMS V4.7.21 allows XSS via the pinglun parameter to cat/index/index/pinglun aka an authenticated comment...

CVE-2014-1400

The entityaccess API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions and read unpublished comments via unspecified vectors...

CVE-2014-1400: Improper Access Control

The entityaccess API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions and read unpublished comments via unspecified vectors...

PT-2018-4170

Name of the Vulnerable Software and Affected Versions Entity API module versions 7.x-1.x through 7.x-1.2 Description The issue allows remote authenticated users to bypass intended access restrictions and read unpublished comments. Recommendations For Entity API module versions 7.x-1.x through...

Gitlab -- multiple vulnerabilities

GitLab reports: Confidential issue comments in Slack, Mattermost, and webhook integrations. Persistent XSS in milestones data-milestone-id. Persistent XSS in filename of merge request...

IBM Security Privileged Identity Manager Information Disclosure Vulnerability (CNVD-2018-08470)

IBM Security Privileged Identity Manager ISPIM is an identity management product within IBM Identity Governance and Management, an identity governance solution from IBM Corporation, USA, that protects, automates and audits the use of privileged identities,... It is designed to protect, automate a...

CVE-2017-1705

IBM Security Privileged Identity Manager 2.1.0 contains left-over, sensitive information in page comments. While this information is not visible at first it can be obtained by viewing the page source. IBM X-Force ID: 134427...

CVE-2017-1705

IBM Security Privileged Identity Manager 2.1.0 contains left-over, sensitive information in page comments. While this information is not visible at first it can be obtained by viewing the page source. IBM X-Force ID: 134427...

CVE-2017-1705

IBM Security Privileged Identity Manager 2.1.0 contains left-over, sensitive information in page comments. While this information is not visible at first it can be obtained by viewing the page source. IBM X-Force ID: 134427...

CVE-2017-1705

CVE-2017-1705 affects IBM Security Privileged Identity Manager (ISPIM) 2.1.0. The issue is sensitive information left in HTML page comments, not visible in the UI but retrievable via page source. Root cause: sensitive data remnants in comments. Impact: potential exposure of privileged context inf...

PT-2018-6386

Name of the Vulnerable Software and Affected Versions: IBM Security Privileged Identity Manager version 2.1.0 Description: The issue concerns sensitive information being left over in page comments, which, although not immediately visible, can be accessed by viewing the page source. Recommendation...

CVE-2017-1705: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security Privileged Identity Manager 2.1.0 contains left-over, sensitive information in page comments. While this information is not visible at first it can be obtained by viewing the page source. IBM X-Force ID: 134427...