WordPress iMember360is 3.9.001 XSS / Disclosure / Code Execution

------------ BACKGROUND ------------ "iMember360is a WordPress plugin that will turn a normal WordPress site into a full featured membership site. It includes all the protection controls you can imagine, yet driven by Infusionsoft's second-to-none CRM and e-commerce engine." --...

Palo Alto Networks PAN-OS 4.1.x < 4.1.16 / 5.0.x < 5.0.10 / 5.1.x < 5.1.5 API Key Bypass Flaw

The remote host is running a version of Palo Alto Networks PAN-OS prior to 4.1.16 / 5.0.10 / 5.1.5. It is, therefore, affected by an API key bypass flaw which allows a remote attacker to bypass the XML API key for a session that has already been authorized. Note that Nessus has not tested for thi...

Management API Key Bypass

An XML API key can be bypassed if a session has been authorized. This can be used in a CSRF or XSS attack. Ref 58976 This issue requires an authenticated administrator session to be successful. This issue affects PAN-OS version 4.1.15 and earlier; 5.0.9 and earlier; 5.1.4 and earlier. Work around...

Management API Key Bypass

An XML API key can be bypassed if a session has been authorized. This can be used in a CSRF or XSS attack. Ref 58976...

CVE-2014-1234

The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process...

Design/Logic Flaw

The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process...

CVE-2014-1234

The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process...

CVE-2014-1234

CVE-2014-1234 affects the paratrooper-newrelic gem (Ruby) v1.0.1. A local attacker can obtain the X-Api-Key by listing the curl process, due to leakage in the process tree. Impact is local exposure of the API key. Public patches or mitigations are not detailed in the provided documents; refer to ...

CVE-2014-1234

The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process...

CVE-2014-1234: Exposure of Sensitive Information to an Unauthorized Actor

The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process...

PT-2014-4026

Name of the Vulnerable Software and Affected Versions paratrooper-newrelic gem version 1.0.1 Description The issue allows local users to obtain the X-Api-Key value by listing the curl process. This could potentially expose sensitive information. Recommendations For paratrooper-newrelic gem versio...

Multi Gather Malware Verifier

This module will check a file for malware on VirusTotal based on the checksum. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'net/http' require 'uri' class MetasploitModule 'Multi Gather Malware Verifier',...

Bio Basespace SDK 0.1.7 Ruby Gem exposes API Key via command line

Title: Bio Basespace SDK 0.1.7 Ruby Gem exposes API Key via command line Date: 11/15/2013 Author: Larry W. Cashdollar, @larry0 Download: http://rubygems.org/gems/bio-basespace-sdk Description: "BaseSpace Ruby SDK is a Ruby based Software Development Kit to be used in the development of Apps and...

Paratrooper-newrelic Gem for Ruby Process Listing API Key Local Disclosure

Paratrooper-newrelic Gem for Ruby contains a flaw in /lib/paratrooper-newrelic.rb. The issue is triggered when the script exposes the API key, allowing a local attacker to gain access to it by monitoring the process tree...

Bio Basespace SDK 0.1.7 API Key Exposure

The Bio Basespace SDK 0.1.7 Ruby Gem API client code passes the APIKEY to a curl command. This exposes the api key to the shell and process table. Another user on the system could snag the api key by just monitoring the process table. Title: Bio Basespace SDK 0.1.7 Ruby Gem exposes API Key via...

Bio Basespace SDK Gem for Ruby Command Line API Key Disclosure

Bio Basespace SDK Gem for Ruby contains a flaw that is due to the API client code passing the APIKEY to a curl command. This may allow a local attacker to gain access to API key information by monitoring the process table...

CVE-2012-2917

Cross-site scripting XSS vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key cnd-key in a share-and-follow-menu page to wp-admin/admin.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key cnd-key in a share-and-follow-menu page to wp-admin/admin.php...

CVE-2012-2917

Cross-site scripting XSS vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key cnd-key in a share-and-follow-menu page to wp-admin/admin.php...

CVE-2012-2917

CVE-2012-2917 affects the WordPress plugin Share and Follow (version ≤ 1.80.3). The vulnerability is a Cross-site Scripting (XSS) flaw triggered when attackers inject script or HTML via the CDN API Key (cnd-key) in a share-and-follow-menu page to wp-admin/admin.php. The NVD entry reports a medium...