[SECURITY] Fedora 21 Update: drupal7-active_tags-2.0-0.9.alpha1.fc21

Active Tags adds a new option to free tagging taxonomies. If selected the taxonomy widget is replaced by a new jQuery enabled tag entry widget. This package provides the following Drupal 7 module: activetags...

blick.ch XSS vulnerability

Vulnerable URL: http://www.blick.ch/widget/id1651417?weatherRegion=nordenxx" onmouseover=window.onerror=alert;throw/XSSPOSED/;//=ajax=2657896=newsBoth Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly...

WordPress Recent Posts Widget Extended Plugin <= 0.9.9.3 - Authenticated XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Upgrade the plugin...

Recent Posts Widget Extended <= 0.9.9.3 - Authenticated XSS (multisite)

XSS in the Recent Posts Widget Extended plugin allows single site admins to change network admin's password with simple CSRF described above POC field. This vulnerability is currently unpatched. 1. Login as single site administrator 2. Add Recent Posts Extended Widget to some widget area 3. Add...

Recent Posts Widget Extended <= 0.9.9.3 - Authenticated XSS (multisite)

XSS in the Recent Posts Widget Extended plugin allows single site admins to change network admin's password with simple CSRF described above POC field. This vulnerability is currently unpatched. PoC 1. Login as single site administrator 2. Add Recent Posts Extended Widget to some widget area 3...

CVE-2015-2872

Multiple cross-site scripting XSS vulnerabilities in Trend Micro Deep Discovery Inspector DDI on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allow remote attackers to inject arbitrary web...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Trend Micro Deep Discovery Inspector DDI on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allow remote attackers to inject arbitrary web...

PT-2015-5953

Name of the Vulnerable Software and Affected Versions Trend Micro Deep Discovery Inspector DDI versions prior to 3.5.1477 Trend Micro Deep Discovery Inspector DDI versions 3.6.x prior to 3.6.1217 Trend Micro Deep Discovery Inspector DDI versions 3.7.x prior to 3.7.1248 Trend Micro Deep Discovery...

CVE-2015-2872: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Trend Micro Deep Discovery Inspector DDI on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allow remote attackers to inject arbitrary web...

WordPress Social Media Widget Plugin <= 2.2 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

CVE-2015-5499

The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission...

Code injection

The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission...

CVE-2015-5499

The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission...

DLA-294-1 wordpress - security update

Bulletin has no description...

CVE-2015-5499: Undefined Security Weakness

The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission...

[SECURITY] [DSA 3332-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3332-1 [email protected] https://www.debian.org/security/ Thijs Kinkhorst August 11, 2015 https://www.debian.org/security/faq -...

PT-2015-7055

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.2.4 Description A cross-site scripting XSS issue exists in the form function in the WP Nav Menu Widget class. This allows remote attackers to inject arbitrary web script or HTML via a widget title. Recommendations...

PT-2015-7053

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.2.4 Description The issue concerns a timing side-channel attack. It is related to the sanitize widget instance function, which does not use a constant-time comparison for widgets. This allows remote attackers to...

WordPress Plugin Recent Backups 0.7 - Arbitrary File Download

Title: Remote file download vulnerability in recent-backups v0.7 wordpress plugin Author: Larry W. Cashdollar, @larry0 Date: 2015-07-13 Download Site: https://wordpress.org/plugins/recent-backups Vendor: https://profiles.wordpress.org/andycheeseman/ Vendor Notified: 0000-00-00 Vendor Contact:...

WordPress Altos Connect Widget 1.3.0 Cross Site Scripting Vulnerability

WordPress Altos Connect Widget plugin version 1.3.0 suffers from a cross site scripting vulnerability. Title: WordPress 'Altos Connect Widget' Plugin Version: 1.3.0 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-15 Download: - https://wordpress.org/plugins/altos-connect/ -...