4690 matches found
CVE-2014-2274
Cross-site request forgery CSRF vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via a request to the...
CVE-2014-2274
Cross-site request forgery CSRF vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via a request to the...
CVE-2014-2550
Cross-site request forgery CSRF vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that enable comments via a request to the disablecommentssettings page to wp-admin/options-general.php...
CVE-2014-2550
The CVE-2014-2550 entry concerns a CSRF vulnerability in the WordPress Disable Comments plugin prior to v1.0.4. The vulnerability allows remote attackers to hijack administrator authentication by issuing requests to the disable_comments_settings page (wp-admin/options-general.php) to enable comme...
CVE-2014-2274
CVE-2014-2274 affects the WordPress plugin “Subscribe To Comments Reloaded” (pre-140219). The vulnerability is a Cross-Site Request Forgery (CSRF) that allows remote attackers to hijack administrator authentication for requests that perform Cross-Site Scripting (XSS) via the subscribe-to-comments...
PT-2018-4201
Name of the Vulnerable Software and Affected Versions Disable Comments plugin versions prior to 1.0.4 for WordPress Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that enable comments via a request to the...
CVE-2014-2274: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via a request to the...
PT-2018-4193
Name of the Vulnerable Software and Affected Versions Subscribe To Comments Reloaded plugin versions prior to 140219 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attack...
CVE-2014-2550: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that enable comments via a request to the disablecommentssettings page to wp-admin/options-general.php...
Joomla! SQL Injection Vulnerability (CNVD-2018-06458)
Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A SQL injection vulnerability exists in the user comments list view in Joomla!...
SQL Injection Vulnerability in cms js/comments.php File
Search once cms video program is a set of ASP + MSSQL/ACCESS PHP + MYSQL environment to build an intelligent station-building system. Search once cms v1.6 php version of the js/comments.php file there is a sql injection vulnerability, an attacker can use the vulnerability to obtain database...
CVE-2017-18215
xvpng.c in xv 3.10a has memory corruption out-of-bounds write when decoding PNG comment fields, leading to crashes or potentially code execution, because it uses an incorrect length value...
CVE-2017-6926
In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the...
CVE-2017-6926
CVE-2017-6926 affects Drupal 8.4.x before 8.4.5 where users with permission to post comments can view content and comments they access to and add comments to that content. The issue’s underlying cause is tied to Drupal’s comment system behavior; mitigations are stated as requiring the comment sys...
CVE-2017-6926: Exposure of Sensitive Information to an Unauthorized Actor
In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the...
Concrete5 < 8.3.0 - Username / Comments Enumeration Exploit
Exploit for php platform in category web applications !/usr/bin/env python3 Concrete5 8.3 vulnerable to Authorization Bypass Through User-Controlled Key IDOR CVE-2017-18195 Chapman R3naissance Schleiss from queue import Queue from threading import Thread from bs4 import BeautifulSoup from tabulat...
Concrete5 CMS < 8.3.0 - Username / Comments Enumeration
!/usr/bin/env python3 Concrete5 8.3 vulnerable to Authorization Bypass Through User-Controlled Key IDOR CVE-2017-18195 Chapman R3naissance Schleiss from queue import Queue from threading import Thread from bs4 import BeautifulSoup from tabulate import tabulate import argparse import requests impo...
Concrete5 Comments on Enumeration Vulnerability
concrete5 is an open source content management system CMS for publishing content on the World Wide Web and intranet. A comment enumeration vulnerability exists in tools/conversations/viewajax.php in Concrete5 before 8.3.0. An unauthenticated user can exploit this vulnerability by posting a reques...
Concrete5 Username / Comments Enumeration
!/usr/bin/env python3 Concrete5 8.3 vulnerable to Authorization Bypass Through User-Controlled Key IDOR CVE-2017-18195 Chapman R3naissance Schleiss from queue import Queue from threading import Thread from bs4 import BeautifulSoup from tabulate import tabulate import argparse import requests impo...