584 matches found
CVE-2017-6924
In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services rest module enabled, the...
CVE-2017-6924
Drupal 8.x before 8.3.7 is affected by CVE-2017-6924 where REST API access can allow users to post approved comments without proper permission if REST module and comment resource are enabled and an attacker can access a user account or anonymous comments. The root cause is a flaw in the REST API ...
PT-2019-8595
Name of the Vulnerable Software and Affected Versions Drupal versions prior to 8.3.7 Description The issue affects sites with the RESTful Web Services rest module enabled, the comment entity REST resource enabled, and where an attacker can access a user account on the site with permissions to pos...
Friday Squid Blogging: Problems with the Squid Emoji
The Monterey Bay Aquarium has some problems with the squid emoji. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...
PayPal: XSSI on refer.xoom.com allows stealing email addresses and posting to Twitter on behalf of victim
Due to a cross-origin configuration, the application at refer.xoom.com could be embedded in script tags on other websites. If a malicious site were open in the same browser as refer.xoom.com, the malicious site could see and extract data from the referral page. This included the email addresses...
Friday Squid Blogging: Good Squid Fishing in the Exmouth Gulf
The conditions are ideal for squid fishing in the Exmouth Gulf in West Australia. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...
Friday Squid Blogging: Roasted Squid with Tomatillo Salsa
Recipe and commentary. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...
Storage-type cross-site scripting vulnerability at the front-end posting message of PawnBuilder CMS
SmallBuild CMS is a website management backend based on the OneThink open source framework. A stored cross-site scripting vulnerability exists in the front-end posting message of PawnBuilder CMS. Attackers by building a CSRF add administrator user can insert malicious js code in the page to obtai...
Friday Squid Blogging: British Columbia "Squid Run" Is a Tourist Attraction
On James Island. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...
Friday Squid Blogging: Calamari Squid Catching Prey
The calamari squid grabs prey three feet away with its fast tentacles. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...
Friday Squid Blogging: Dead Squid on Prince Edward Island
A beach on Prince Edward Island is littered with dead squid. No one knows why. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...
Friday Squid Blogging: Antifungal Squid-Egg Coating
The Hawaiian bobtail squid coats its eggs with antifungal bacteria. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...
Friday Squid Blogging: Fried Squid with Turmeric
Good-looking recipe. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...
Airbnb Knowledge Repo Cross-Site Scripting Vulnerability
Airbnb Knowledge Repo is a suite of knowledge sharing platforms. The platform supports features such as data storage and utility management. A cross-site scripting vulnerability exists in Airbnb Knowledge Repo version 0.7.4. A remote attacker can exploit this vulnerability to inject arbitrary web...
CVE-2018-10527
EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated by the /admin/index/index.htmllistarticle URI...
Cross site scripting
EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated by the /admin/index/index.htmllistarticle URI...
CVE-2018-10527
EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated by the /admin/index/index.htmllistarticle URI...
CVE-2018-10527
EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated by the /admin/index/index.htmllistarticle URI...
CVE-2018-10527
CVE-2018-10527 affects EasyCMS 1.3 and is described as a Stored XSS vulnerability. The issue affects four input fields when posting an article: title, keyword, abstract, and content, as demonstrated by the /admin/index/index.html#listarticle URI. The related documents confirm the existence of the...