CVE-2013-7233

Cross-site request forgery CSRF vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier allows remote attackers to hijack the authentication of administrators for requests that move comments to the moderation list...

Windows Gather Active Directory User Comments

This module will enumerate user accounts in the default Active Domain AD directory which contain 'pass' in their description or comment case-insensitive by default. In some cases, such users have their passwords specified in these fields. This module requires Metasploit:...

SA-CONTRIB-2013-086 - Monster Menus - Access bypass

Monster Menus includes the ability to protect the visibility of comments for each node based on hierarchical permissions. However, a carefully-crafted URL could be used to bypass these permissions, allowing an anonymous user to view the comments associated with certain nodes. In order for this fl...

ILIAS eLearning CMS 4.3.4 4.4 - Persistent Cross-Site Scripting

ILIAS eLearning CMS 4.3.4 4.4 - Persistent Cross-Site Scripting Document Title: =============== ILIAS eLearning 4.3.4 & 4.4 CMS - Persistent Notes Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1122 Release Date: ============= 2013-10-...

ILIAS eLearning CMS 4.3.4 < 4.4 - Persistent Cross-Site Scripting

Document Title: =============== ILIAS eLearning 4.3.4 & 4.4 CMS - Persistent Notes Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1122 Release Date: ============= 2013-10-27 Vulnerability Laboratory ID VL-ID:...

ILIAS eLearning 4.3.4 / 4.4 Cross Site Scripting

Document Title: =============== ILIAS eLearning 4.3.4 & 4.4 CMS - Persistent Notes Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1122 Release Date: ============= 2013-10-27 Vulnerability Laboratory ID VL-ID:...

ILIAS eLearning 4.3.4 & 4.4 CMS - Persistent Vulnerability

Document Title: =============== ILIAS eLearning 4.3.4 & 4.4 CMS - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1122 Release Date: ============= 2013-10-28 Vulnerability Laboratory ID VL-ID: ====================================...

Confluence notifications generated on jira issues no longer readable

A user created a ticket in jira, which was moved to another section, where the creator of the ticket has no rights. But the creator recieved a notification in confluence about a new comment on the ticket, he was no longer able to read and the comment was quoted in confluence. I think, this is a...

Confluence notifications generated on jira issues no longer readable

A user created a ticket in jira, which was moved to another section, where the creator of the ticket has no rights. But the creator recieved a notification in confluence about a new comment on the ticket, he was no longer able to read and the comment was quoted in confluence. I think, this is a...

CVE-2013-5917

SQL injection vulnerability in wp-comments-post.php in the NOSpam PTI plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the commentpostID parameter...

CVE-2013-5917

The CVE-2013-5917 entry concerns the WordPress NOSpamPTI plugin (version 2.1). The vulnerability is a SQL injection in wp-comments-post.php via the comment_post_ID parameter, enabling remote attackers to manipulate the database and potentially exfiltrate data. Multiple connected sources confirm t...

PT-2013-5868

Name of the Vulnerable Software and Affected Versions NOSpam PTI plugin version 2.1 for WordPress Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the comment post ID parameter in the wp-comments-post.php file. Recommendations For NOSpam PTI...

CVE-2013-5917: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in wp-comments-post.php in the NOSpam PTI plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the commentpostID parameter...

WordPress NOSpamPTI 2.1 Blind SQL Injection

NOSpamPTI Wordpress plugin Blind SQL Injection Vendor product description NOSpamPTI eliminates the spam in your comment box so strong and free, developed from the idea of Nando Vieira http://bit.ly/d38gB8, but some themes do not support changes to the functions.php to this we alter this function...

[SECURITY] Fedora 19 Update: drupal7-theme-zen-5.4-1.fc19

Zen is a powerful, yet simple, HTML5 starting theme with a responsive, mobile-first grid design. If you are building your own standards-compliant theme, you will find it much easier to start with Zen than to start with Garland or Stark. This theme has fantastic online documentation...

Cross site scripting

Cross-site scripting XSS vulnerability in article.php in Anchor CMS 0.9.1, when comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Name field. NOTE: some sources have reported that comments.php is vulnerable, but certain functions from comments.php are us...

PT-2013-5101

Name of the Vulnerable Software and Affected Versions OpenEMR version 4.1.1 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the note parameter in the interface/main/onotes/office comments full.php file...

Fedora 19 : fdupes-1.51-1.fc19 (2013-13176)

Upstream - Added support for 64-bit file offsets on 32-bit systems. - Using tty for interactive input instead of regular stdin. This is to allow feeding filenames via stdin in future versions of fdupes without breaking interactive deletion feature. - Fixed some typos in --help. - Turned C++ style...

Fedora 18 : fdupes-1.51-1.fc18 (2013-13166)

Upstream - Added support for 64-bit file offsets on 32-bit systems. - Using tty for interactive input instead of regular stdin. This is to allow feeding filenames via stdin in future versions of fdupes without breaking interactive deletion feature. - Fixed some typos in --help. - Turned C++ style...

Anchor CMS 0.9.1 - Persistent Cross-Site Scripting

Exploit Title : AnchorCMS Stored XSS exploit v0.9.1 Exploit Author: DURAKIBOX / dn5 Website : halisduraki.com Email : [email protected] Date : 18.7.2013. CMS uri : http://anchorcms.com/ Version : AnchorCMS File : article.php file shows article/post page with text written by owners. If owner enable...