WordPress Plugin Freshmail 1.5.8 - SQL Injection

Exploit Title: Unauthenticated SQL Injection on Wordpress Freshmail 1 Google Dork: N/A Date: 05/05/2015 Exploit Author: Felipe Molina de la Torre @felmoltor Vendor Homepage: http://freshmail.com/ Version: getrow'select from '.$wpdb-prefix.'fmforms where formid="'.$result'fmformid'.'";'; ... 3...

The vulnerability of the CentOS operating system allows attackers to compromise the confidentiality and accessibility of protected information.

The vulnerability of the systemtap-debuginfo-1.6 package in the CentOS operating system can lead to a violation of the confidentiality and accessibility of protected information. Exploiting this vulnerability can be carried out locally...

The vulnerability of the Red Hat Enterprise Linux operating system allows attackers to compromise the confidentiality and accessibility of protected information.

The vulnerability of the systemtap-1.6 package of the Red Hat Enterprise Linux operating system can lead to a violation of the confidentiality and accessibility of protected information. This vulnerability can be exploited locally...

[SECURITY] Fedora 22 Update: jboss-connector-1.6-api-1.0.1-1.fc22

Java EE Connector Architecture 1.6 API classes...

UBUNTU-CVE-2015-1317

Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code by deleting all WebContents while a RenderProcessHost instance still exists...

Fedora 22 : drupal7-entity-1.6-1.fc22 (2015-2783)

7.x-1.6 See SA-CONTRIB-2015-053 - Entity API - Cross Site Scripting XSS Changes since 7.x-1.5 : - by klausi: Sanitize field labels before passing them to the Token API. - Issue 2264079 by Amitaibu, fago: Fixed $wrapper-access might be wrong for single entity reference field. - Issue 2039601 by...

Mandriva Linux Security Advisory : python-django (MDVSA-2015:109)

Updated python-django packages fix security vulnerabilities : Jedediah Smith discovered that Django incorrectly handled underscores in WSGI headers. A remote attacker could possibly use this issue to spoof headers in certain environments CVE-2015-0219. Mikko Ohtamaa discovered that Django...

CVE-2015-2317

CVE-2015-2317 affects Django’s utils.http.is_safe_url, where URL validation is insufficient in Django versions prior to 1.4.20, 1.5.x, 1.6.x prior to 1.6.11, 1.7.x prior to 1.7.7, and 1.8.x prior to 1.8c1. This enables remote attackers to perform cross-site scripting via a control character in a ...

CVE-2015-0245

D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service activation failure error returned by leveraging a race condition involving sending an...

Oracle Java 1.6.x Detection

Binary data 8893.prm...

MyBB 1.6.x < 1.6.11 Multiple Vulnerabilities

Binary data 8613.prm...

Sql injection

ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when showhiddeninitial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries...

CVE-2015-0222

ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when showhiddeninitial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries...

CVE-2015-0222

ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when showhiddeninitial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries...

UBUNTU-CVE-2015-0222

ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when showhiddeninitial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries...

CVE-2014-3556

The CVE-2014-3556 entry affects nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4. The STARTTLS implementation in mail/ngx_mail_smtp_handler.c allows an MITM to inject commands into encrypted SMTP sessions by sending a cleartext command after TLS is established, due to insufficient I/O bu...

Code injection

D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service prevention of new connections and connection drop by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix fo...

CVE-2014-3209

The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file...

Design/Logic Flaw

The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file...

CVE-2014-3209

The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file...