CVE-2014-9101

Multiple cross-site request forgery CSRF vulnerabilities in Oxwall 1.7.0 build 7907 and 7906 and SkaDate Lite 2.0 build 7651 allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks or possibly have other unspecified impact v...

CVE-2014-8986

Cross-site scripting XSS vulnerability in the selection list in the filters in the Configuration Report page admconfigreport.php in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via a crafted config option, a different vulnerability than...

Docker Releases Security Advisory

Docker has released a critical security advisory to address vulnerabilities in Docker versions prior to version 1.3.2, one of which could allow an attacker to escalate privileges and execute remote code on an affected system. US-CERT encourages users and administrators to review Docker's Security...

WordPress Releases Security Update

WordPress 4.0.1 has been released to address multiple vulnerabilities, one of which could allow a site to be compromised by a remote attacker. WordPress 3.9.2 and earlier are affected by this vulnerability. US-CERT recommends users and administrators review the WordPress Maintenance and Security...

CVE-2014-9003

Cross-site request forgery CSRF vulnerability in Lantronix xPrintServer allows remote attackers to hijack the authentication of administrators for requests that modify configuration, as demonstrated by executing arbitrary commands using the c parameter in the rpc action...

Drupal Releases Security Advisory

Drupal has released an advisory to address multiple vulnerabilities in Drupal core 6.x versions prior to 6.34 and Drupal core 7.x versions prior to 7.34, one of which could allow a remote attacker to cause a denial of service. US-CERT encourages users and administrators to review Drupal's Securit...

Microsoft Releases Out-of-Band Security Bulletin for Windows Kerberos Vulnerability

Microsoft has released security updates to address a remote elevation of privilege vulnerability which exists in implementations of Kerberos KDC in Microsoft Windows. Exploitation of this vulnerability could allow a remote attacker to take control of an affected system. US-CERT encourages users a...

CVE-2014-8953

Multiple cross-site request forgery CSRF vulnerabilities in Php Scriptlerim Who's Who script allow remote attackers to hijack the authentication of administrators or requests that 1 add an admin account via a request to filepath/yonetim/plugin/adminsave.php or have unspecified impact via a reques...

CVE-2014-8953

Multiple cross-site request forgery CSRF vulnerabilities in Php Scriptlerim Who's Who script allow remote attackers to hijack the authentication of administrators or requests that 1 add an admin account via a request to filepath/yonetim/plugin/adminsave.php or have unspecified impact via a reques...

Apple Releases Security Updates for iOS, OS X Yosemite, and Apple TV

Apple released security updates for iOS devices, OS X Yosemite and Apple TV to address multiple vulnerabilities, one of which could allow remote attackers to execute arbitrary commands. Updates available include: iOS 8.1.1 for iPhone 4s and later, iPod touch 5th generation and later, and iPad 2 a...

CVE-2014-8948

Cross-site request forgery CSRF vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hijack the authentication of administrators for requests that with an unspecified impact via the i4wtrace parameter. NOTE: this can be leveraged with CVE-2014-89...

Code injection

The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the i4wtrace parameter. NOTE: this can be leveraged with CVE-2014-8948 to allow remote attackers to execute code. NOTE: it is not clear...

CVE-2014-8948

Cross-site request forgery CSRF vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hijack the authentication of administrators for requests that with an unspecified impact via the i4wtrace parameter. NOTE: this can be leveraged with CVE-2014-89...

CentOS 5 : sudo (CESA-2013:1353)

An updated sudo package that fixes multiple security issues and several bugs is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

CVE-2014-8654

Multiple cross-site request forgery CSRF vulnerabilities in Compal Broadband Networks CBN CH6640E and CG6640E Wireless Gateway hardware 1.0 with firmware CH6640-3.5.11.7-NOSH allow remote attackers to hijack the authentication of administrators for requests that 1 have unspecified impact on DDNS...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Compal Broadband Networks CBN CH6640E and CG6640E Wireless Gateway hardware 1.0 with firmware CH6640-3.5.11.7-NOSH allow remote attackers to hijack the authentication of administrators for requests that 1 have unspecified impact on DDNS...

CVE-2014-8578

Cross-site scripting XSS vulnerability in the Groups panel in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475...

DEBIAN-CVE-2014-8578

Cross-site scripting XSS vulnerability in the Groups panel in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475...

CVE-2014-3475

Cross-site scripting XSS vulnerability in the Users panel admin/users/ in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than...

Cross site scripting

Cross-site scripting XSS vulnerability in the Users panel admin/users/ in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than...