4569 matches found
Design/Logic Flaw
The Entity API module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to node comments, which allows remote authenticated users to read the comments via unspecified vectors. NOTE: this identifier was SPLIT per ADT5 due to different researcher organizations. CVE-2013-7391 was...
CVE-2013-4273
The Drupal Entity API module (7.x-1.x) before 7.x-1.2 fails to properly enforce access restrictions for node comments when used with Views field/area plugins, allowing remote authenticated users to read restricted comments via a View (and is split from CVE-2013-4273’s View vector). The issue spec...
CVE-2013-4273
The Entity API module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to node comments, which allows remote authenticated users to read the comments via unspecified vectors. NOTE: this identifier was SPLIT per ADT5 due to different researcher organizations. CVE-2013-7391 was...
CVE-2013-4273: Undefined Security Weakness
The Entity API module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to node comments, which allows remote authenticated users to read the comments via unspecified vectors. NOTE: this identifier was SPLIT per ADT5 due to different researcher organizations. CVE-2013-7391 was...
PT-2014-2768
Name of the Vulnerable Software and Affected Versions Entity API module versions 7.x-1.x through 7.x-1.1 Description The issue allows remote authenticated users to read node comments via unspecified vectors due to improper access restriction. Recommendations For Entity API module versions 7.x-1.x...
JPEG Files Containing Suspicious Comments
Certain JPEG files may contain malicious code, hidden within the comments marker...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in vcc.js.php in the Verification Code for Comments plugin 2.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 vp, 2 vs, 3 l, 4 vu, or 5 vm parameter...
CVE-2014-4565
The CVE-2014-4565 issue affects the WordPress plugin Verification Code for Comments (vcc.js.php) version 2.1.0 and earlier. The vulnerability is a multiple parameter reflected XSS in vcc.js.php, exploitable via the five parameters (vp, vs, l, vu, vm), allowing an attacker to inject arbitrary scri...
CVE-2014-4565: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in vcc.js.php in the Verification Code for Comments plugin 2.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 vp, 2 vs, 3 l, 4 vu, or 5 vm parameter...
PT-2014-5980
Name of the Vulnerable Software and Affected Versions Verification Code for Comments plugin versions 2.1.0 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the vp, vs, l, vu, or vm parameters in the vcc.js.php file. This can lead to cross-site...
Online Subtitles Workshop XSS Vulnerability
No description provided by source. =================================================================================== Online Subtitles Workshop XSS vulnerabilities =================================================================================== Exploit Title: Online Subtitles Workshop XSS...
geoBlog MOD_1.0 deleteblog.php id Variable Remote Arbitrary Blog Deletion
No description provided by source. source: http://www.securityfocus.com/bid/24966/info geoBlog is prone to multiple security-bypass vulnerabilities because the application fails to properly validate users when deleting user blogs and comments. An attacker may exploit these issues to delete blogs...
Kayako eSupport <= 2.3.1 (subd) Remote File Inclusion Vulnerability
No description provided by source. Script: Kayako eSupport = 2.3.1 Vendor: Kayako www.kayako.com Discovered: beford xbefordx gmail com Comments: It seems like the vendor silently fixed the issue in the current version more like since v2.3.5 withouth warning users of previous versions, noobs...
myBloggie <= 2.1.4 (trackback.php) Multiple SQL Injections Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo MyBloggie = 2.1.4 trackback.php multiple SQL injections vulnerability /\n; echo administrative credentials disclosure exploit\n; echo by rgod [email protected]\n; echo site: http://retrogod.altervista.org\n\n; / works...
Micro CMS 1.0 b1 - Persistent XSS Vulnerability
No description provided by source. Title : Micro CMS Persistent Cross-Site Scripting Vulnerability. Author : Veerendra G.G from SecPod Technologies www.secpod.com Vendor : http://www.micro-cms.com/ Advisory : http://secpod.org/blog/?p=135 http://secpod.org/advisories/SECPODMicroCMS.txt Version :...
Webee Comments Component 1.1/1.2 for Joomla! index2.php articleId SQL Injection
No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register import re class TestPOCPOCBase: vulID = '86842' ssvid version = '1.0' author = 'kikay' vulDate = '2010-02-22' createDate ...
ILIAS eLearning CMS 4.3.4 & 4.4 - Persistent XSS
No description provided by source. Document Title: =============== ILIAS eLearning 4.3.4 & 4.4 CMS - Persistent Notes Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1122 Release Date: ============= 2013-10-27 Vulnerability Laboratory I...
GuestBookPlus HTML Injection & Bypass Comments Limit
No description provided by source. ======================================================================= In the name of ALLAH ! ======================================================================= GuestBookPlus Script PHP HTML Injection Vuln...
GENU CMS 2012.3 - Multiple SQL Injection Vulnerabilities
No description provided by source. Title: ====== GENU CMS 2012.3 - Multiple SQL Injection Vulnerabilities Date: ===== 2012-04-30 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=538 VL-ID: ===== 538 Introduction: ============= GENU is a Content Management System written...
Skeletonz CMS Permanent XSS Vulnerability
No description provided by source. Exploit Title: Xss on skeletonz-simple dynamic cms in the section comments Google Dork: Date: 27/11/10 Author: Jordan Diaz aka Jbyte Software Link: http://orangoo.com/skeletonz/ Version: 1.0 Tested on: Windows xp CVE : The follow xss is located in the section of...