CVE-2015-2807: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter...

CVE-2 0 1 5-4 4 8 3: Use the feed Protocol to bypass the Firefox Mixed Content Blocker-bug warning-the black bar safety net

In Firefox 4 0. fixes a bug number for CVE-2 0 1 5-4 4 8 3 BUG. Usually Firefox can prevent the following Mixed Content mixed content: the https://mkpocapp.appspot.com/bug1148732/victim In short: the https site has a portion of the content is via the http transmission, such as resource files, etc...

WordPress sourceAFRICA 0.1.3 Cross Site Scripting

Exploit Title : Wordpress sourceAFRICA Plugin Cross Site Scripting Exploit Author : Ashiyane Digital Security Team Vendor Homepage : https://wordpress.org/plugins/sourceafrica/ Date: 2015-08-29 Tested On : Elementary Os - Firefox Software Link :...

Google Chrome < 44.0.2403.157 Bypass Anti-XSS filter Vulnerability

影响版本：Google Chrome〈 44.0.2403.157 已知Google Chrome具有XSS防护机制，防止执行XSS中的的JS代码。下面有一段PHP代码：?php // Echo the value of parameter one echo "This is text1:".$GET'text1'."brbr"; // Echo the value of parameter two echo "This is text2:".$GET'text2'."brbr"; ?...

WordPress Role Scoper Plugin <= 1.3.64 - Cross Site Scripting

Because of this vulnerability, authenticated administrators can inject HTML or JS code. Solution Upgrade the plugin...

WordPress Social Locker Plugin <= 4.2.0 - Reflected Cross Site Scripting

Because of this vulnerability, authenticated administrators can inject HTML or JS code. Solution Update the plugin...

WordPress Multicons Plugin <= 2.1 - Cross Site Scripting (XSS)

Because of this vulnerability, authenticated administrators can store HTML or JS code in plugin configuration values. Solution Update the plugin...

WordPress Post Video Players Plugin <= 1.136 - XSS

Because of this vulnerability, authenticated users like editors can store HTML or JS code. Solution Update the plugin...

WordPress Crontrol Plugin <= 1.2.3 - Cross Site Scripting (XSS)

Because of this vulnerability, authenticated administrators can store HTML and JS code. Vulnerable parameters: "idhookname", "idsig", "idnextrun", "idargscode". Solution Update the plugin...

WordPress YITH Maintenance Mode Plugin <= 1.1.4 - Cross-Site Scripting

Because of this vulnerability, authenticated administrators can store HTML and JS code. Solution Update the plugin...

WordPress Social Bookmarking Light Plugin <= 1.7.9 - Cross Site Scripting

Because of this vulnerability, authenticated administrators can store HTML or JS code. Solution Update the plugin...

WordPress Category Order and Taxonomy Terms Order Plugin <= 1.4.4 - XSS

Because of this vulnerability, authenticated administrators can inject HTML and JS code. Solution Update the plugin...

CVE-2015-4484: Improper Restriction of Operations within the Bounds of a Memory Buffer

The js::jit::AssemblerX86Shared::lockaddl function in the JavaScript implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to cause a denial of service application crash by leveraging the use of shared memory and accessing 1 an Atomics object or 2 ...

PT-2015-1899

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 40.0 Firefox ESR versions prior to 38.2 Description The issue is caused by a buffer overflow in the js::jit::AssemblerX86Shared::lock addl function. This can be exploited by a remote attacker to cause a denial of...

WordPress Email Encoder Bundle Plugin <= 1.4.1 - Cross Site Scripting

Because of this vulnerability, unauthenticated users can inject HTML or JS code. Solution Update the plugin...

Python Network Recon Framework: ivre

IVRE Instrument de veille sur les réseaux extérieurs or DRUNK Dynamic Recon of UNKnown networks is a network recon framework, including two modules for passive recon one p0f -based and one Bro -based and one module for active recon mostly Nmap -based, with a bit of ZMap . External programs /...

WordPress Huge-IT Slider 2.7.5 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: WordPress: wordpress huge-it-slider 2.7.5 & Persistent JS-HTML Code injection, Arbitrary slider deletion Date: 2015-06-23 Google Dork: intitle:"index of" intext:"/wp-content/plugins/slider-image/" Exploit Author: Joaquin Ramirez...

WordPress Huge IT Slider Plugin 2.7.5 - Multiple Vulnerabilities

There are multiple vulnerabilities in this plugin, such as cross-site request forgery and Persistent JS/HTML Injection. These vulnerabilities allow an attacker to make a user with access privileges to a page and inject JavaScript into the database. Solution Upgrade the plugin...

Responsive Portfolio Wall [mod_repowa], 1.0 and below, XSS (Cross Site Scripting)

Responsive Portfolio Wall modrepowa, 1.0, XSS Cross Site Scripting Extension includes vulnerable version of JS library prettyPhoto Vulnerability fixed in version 1.1 Update notice: http://www.joomlabusiness.net/module/responsive-portfolio-wall...

BK MultiThumb [multithumb], 3.7.1 and below, XSS (Cross Site Scripting)

BK-MultiThumb, 3.7.1 and below, XSS Cross Site Scripting Extension contains known vulnerable version of JS library prettyPhoto. The vulnerability in JS file was patched by extension author on basis of 3.1.5 file. Update notice: http://joomla.rjews.net/bk-multithumb...