354 matches found
WordPress Users Ultra 1.5.50 Cross Site Scripting
Exploit Title: WordPress Users Ultra Plugin Persistence XSS Discovery Date: 2015/10/20 Public Disclosure Date: 2015/12/01 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://usersultra.com Software Link: https://wordpress.org/plugins/users-ultra/...
WordPress Payment Form For PayPal Pro 1.0.1 XSS Vulnerability
WordPress DWBooster Payment Form for PayPal Pro plugin version 1.0.1 suffers from a cross site scripting vulnerability. Vulnerability title: Multiple Reflected XSS in Payment Form for PayPal Pro version 1.0.1 WordPress plugin CVE: CVE-2015-7666 Vendor: WordPress DWBooster Product: Payment Form fo...
WordPress Jetpack Plugin Security Patch
After a few critical bugs were recently discovered and patched in the core WordPress engine—a rarity with WordPress-related security issues—order has apparently been restored with the discovery of a critical vulnerability in a popular plugin. Insecure plugins have been at the heart of numerous...
WordPress vulnerability analysis CVE-2 0 1 5-5 7 1 4 & CVE-2 0 1 5-5 7 1 5-the vulnerability warning-the black bar safety net
Recently, WordPress released a new version 4. 3. 1, which fixes a few serious security issues, which includes by Check Point filed a cross-site scripting Vulnerability, CVE-2 0 1 5-5 7 1 4 and a privilege escalation Vulnerability, CVE-2 0 1 5-5 7 1 5 It. 8 beginning of the month, Check Point, in...
WordPress < 4.3.1 Multiple Vulnerabilities
According to its version number, the WordPress application running on the remote web server is prior to 4.3.1. It is, therefore, potentially affected by multiple vulnerabilities : - A cross-site scripting vulnerability exists when processing shortcode tags due to improper validation of...
PHP 4.3 socket_iovec_alloc() Integer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/7187/info A vulnerability has been reported in PHP versions 4.3.1 and earlier. The problem occurs in the socketiovecalloc and may allow an attacker to corrupt memory. Specifically, the affected function fails to carry out...
Design/Logic Flaw
typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content edit forms, which allows remote attackers to hide fields on the forms via a crafted URL...
PYSEC-2014-52
traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges to cause a denial of service infinite loop and resource consumption via unspecified vectors related to "retrieving information for certain resources."...
CVE-2013-4198
mailpassword.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality...
CVE-2013-4200
The isURLInPortal method in the URLTool class in inportal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allowexternalloginsites filtering property, redirect users to...
Fedora 20 : xen-4.3.1-6.fc20 (2013-23251)
Disaggregated domain management security status update, IOMMU TLB flushing may be inadvertently suppressed Lock order reversal between pagealloclock and mmrwlock, Hypercalls exposed to privilege rings 1 and 2 of HVM guests Insufficient TLB flushing in VT-d iommu code Note that Tenable Network...
Solr: XML eXternal Entity (XXE) flaw in DocumentAnalysisRequestHandler
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Enti...
Fedora 20 : xen-4.3.1-1.fc20 (2013-20517)
update to xen-4.3.1, Lock order reversal between page allocation and grant table lock ocaml xenstored mishandles oversized message replies systemd changes to allow oxenstored to be used instead of xenstored Note that Tenable Network Security has extracted the preceding description block directly...
Bugzilla - editflagtypes.cgi Multiple Cross-Site Scripting Vulnerabilities
Bugzilla - editflagtypes.cgi Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/63204/info Bugzilla is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. An attacker may leverage these issues t...
Double free
The UDP process in Cisco IOS XR 4.3.1 does not free packet memory upon detecting full packet queues, which allows remote attackers to cause a denial of service memory consumption via UDP packets to listening ports, aka Bug ID CSCue69413...
CVE-2013-2339
HP Smart Zero Core 4.3 and 4.3.1 on the t410 All-in-One Smart Zero Client, t410 Smart Zero Client, t510 Flexible Thin Client, t5565z Smart Client, t610 Flexible Thin Client, and t610 PLUS Flexible Thin Client allows local users to obtain sensitive information, modify data, or cause a denial of...
Code injection
HP Smart Zero Core 4.3 and 4.3.1 on the t410 All-in-One Smart Zero Client, t410 Smart Zero Client, t510 Flexible Thin Client, t5565z Smart Client, t610 Flexible Thin Client, and t610 PLUS Flexible Thin Client allows local users to obtain sensitive information, modify data, or cause a denial of...
civic crm 422
upload exploit /RFI 260413 developer http://civicrm.org/category/civicrm-blog-categories/civicrm-v43 release 4.3.1 Authors:...
