PT-2015-6229

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.2.1 Description A cross-site scripting XSS issue exists due to improper storage of long comments in the MySQL database, allowing remote attackers to inject arbitrary web script or HTML. Recommendations For version...

WordPress < 4.2.1 Comments Stored XSS Vulnerability

WordPress is prone to a stored cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WordPress <= 3.9.5 / 4.1.x < 4.1.4 / 4.2.x < 4.2.1 Comments Stored XSS

According to its version number, the WordPress application running on the remote web server is affected by an input validation flaw that allows an unauthenticated attacker to inject JavaScript into WordPress comments, which could result in a stored cross-site scripting attack being carried out wh...

Hacking WordPress Website with Just a Single Comment

Most of the time, we have reported about WordPress vulnerabilities involving vulnerable plugins, but this time a Finnish security researcher has discovered a critical zero-day vulnerability in the core engine of the WordPress content management system. Yes, you heard it right. The WordPress CMS...

WordPress 4.2 Cross Site Scripting

Overview Current versions of WordPress are vulnerable to a stored XSS. An unauthenticated attacker can inject JavaScript in WordPress comments. The script is triggered when the comment is viewed. If triggered by a logged-in administrator, under default settings the attacker can leverage the...

WordPress <= 4.2 - Stored XSS

A stored XSS affects the WordPress core. This vulnerability allows an attacker to inject JavaScript in WordPress comments, change the administrator’s password, create new accounts or execute arbitrary code on the server through the theme and plugin editors. Solution Update WordPress...

Hacking YouTube To Get Spoofed Comments on Videos

A security researcher has discovered a critical vulnerability in Google-owned YouTube that could allow anyone to make the comment posted by any celebrity or public figure on some YouTube video appear on his or her own YouTube video, impersonating that celeb. Just a few weeks ago we reported about...

Crayon Syntax Highlighter <= 2.6.10 - Local File Disclosure

The local file syntax highlighting feature of Crayon Syntax Highlighter doesn't check the path of the file to process. Also, by default, this feature is usable through public comments. This allows unauthenticated visitors to see the content of any file where the web server has read permissions,...

Nokogiri gem contains several vulnerabilities in libxml2 and libxslt

Several vulnerabilities were discovered in the libxml2 and libxslt libraries that the Nokogiri gem depends on. CVE-2015-1819 A denial of service flaw was found in the way libxml2 parsed XML documents. This flaw could cause an application that uses libxml2 to use an excessive amount of memory...

Telescope 0.9.2 - Markdown Persistent XSS Vulnerability

Exploit for php platform in category web applications Exploit Title: Persistent XSS via Markdown on Telescope = 0.9.2 Date: Aug 22 2014 Exploit Author: shubs Vendor Homepage: http://www.telescopeapp.org/ Software Link: https://github.com/TelescopeJS/Telescope Version: = 0.9.2 CVE : CVE-2014-5144...

openEMR 4.2.0 Cross Site Scripting / SQL Injection

Advisory: Multiple reflecting/stored XSS- and SQLi-vulnerabilities in openEMR v.4.2.0 Advisory ID: SROEADV-2015-08 Author: Steffen Rösemann Affected Software: openEMR v.4.2.0 Release-date: 28th Dec 2014 Vendor URL: http://www.open-emr.org Vendor Status: patched CVE-ID: to be assigned after releas...

EnanoCMS 1.1.8pl1 XSS Vulnerability

Exploit Title: EnanoCMS 1.1.8pl1 XSS Vulnerability Google Dork: "Website engine powered by Enano" Date: 24-2-2015 Exploit Author: Dennis Veninga Vendor Homepage: http://enanocms.org Version: 1.1.8pl1 Tested on: Firefox 36 & Chrome 38 / W8.1-x64 XSS Vulnerability in comments:...

Telescope 0.9.2 - Markdown Persistent Cross-Site Scripting

Telescope 0.9.2 - Markdown Persistent Cross-Site Scripting Exploit Title: Persistent XSS via Markdown on Telescope = 0.9.2 Date: Aug 22 2014 Exploit Author: shubs Vendor Homepage: http://www.telescopeapp.org/ Software Link: https://github.com/TelescopeJS/Telescope Version: = 0.9.2 CVE :...

PT-2015-5707

Name of the Vulnerable Software and Affected Versions WPML plugin versions prior to 3.1.9 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the lang parameter in the HTTP Referer header in a "wp-link-ajax" action to "comments/feed"...

Vimeo: Insecure Direct Object References that allows to read any comment (even if it should be private)

Dear Vimeo Team, in combination with my previous bug i discovered that it was possible to read any comment on any video even if the video is private: I did a short POC on the Insecure Direct Object Reference. If an attacker wants to exploit this issue he has to know the ID of the comment, which...

Debian DSA-3183-1 : movabletype-opensource - security update

Multiple vulnerabilities have been discovered in Movable Type, a blogging system. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2013-2184 Unsafe use of Storable::thaw in the handling of comments to blog posts could allow remote attackers to include and...

Vimeo: A user can post comments on other user's private videos

It is possible for a user to post comments on other's private videos. Steps to verify: 1. Log into www.vimeo.com as Alice and create a video say, AliceVideo with id - 118026546 with 'Allow anyone to see my videos' setting. 2. Login as Bob and create an album say, BobAlbum with album id 3295969. 3...

ThinkSAAS设计缺陷可任意删除他人评论

简要描述： 设计错误吧 详细说明： 我觉得这个不应该是你们的本意吧？ 漏洞证明： 这是他们官方站点就是用他们自己的系统搭建的 http://www.thinksaas.cn/vote/ 投票处，可删除任意用户评论 不用截断 不用改参数 我登陆的这个以18结尾的号，可以删除以30为结尾的号的评论...

Restrictions not applied for inline comments in attachments

When there is a comment for a file which is attached to a restricted page, all users can see the comment, even the ones who are not allowed to see the page and its attachments. h3. Workaround for 5.7 There is no workaround for customers running Confluence 5.7. Customers are advised to upgrade to...

Restrictions not applied for inline comments in attachments

When there is a comment for a file which is attached to a restricted page, all users can see the comment, even the ones who are not allowed to see the page and its attachments. h3. Workaround for 5.7 There is no workaround for customers running Confluence 5.7. Customers are advised to upgrade to...