CVE-2014-5199

Cross-site request forgery CSRF vulnerability in the WordPress File Upload plugin wp-file-upload before 2.4.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. NOTE: some of these details are...

CVE-2014-5196

Cross-site request forgery CSRF vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the...

CVE-2014-5199

CVE-2014-5199 is a CSRF vulnerability in the WordPress File Upload plugin (wp-file-upload) for WordPress, affecting versions before 2.4.2. The issue allows remote attackers to hijack the administrator’s authentication for requests that change plugin settings via unspecified vectors. Root cause is...

WordPress File Upload Plugin <= 2.4.1 - CSRF

Because of this vulnerability, the attackers can hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. Solution Update the plugin...

“Invalid Credentials” Error Adding a Hyper-V Host Using a Local Account

Article Applicability This article relates to an error that only occurs when Veeam Backup & Replication is deployed on a Windows machine. With the Veeam Software Appliance, to add a Hyper-V host using credentials, it requires that both the appliance and the Windows machine are added to the same...

CVE-2014-5180

SQL injection vulnerability in the videos page in the HDW Player Plugin hdw-player-video-player-video-gallery 2.4.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the edit action to wp-admin/admin.php...

Sql injection

SQL injection vulnerability in the videos page in the HDW Player Plugin hdw-player-video-player-video-gallery 2.4.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the edit action to wp-admin/admin.php...

Sql injection

SQL injection vulnerability in the All Video Gallery all-video-gallery plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an edit action in the allvideogalleryvideos page to wp-admin/admin.php...

CVE-2014-5186

The All Video Gallery (WordPress) plugin 1.2 is affected by CVE-2014-5186 through an SQL injection in the id parameter of the allvideogallery_videos edit action (wp-admin/admin.php). Remote authenticated administrators can execute arbitrary SQL commands. Remediation guidance from connected source...

CVE-2014-5180

SQL injection vulnerability in the videos page in the HDW Player Plugin hdw-player-video-player-video-gallery 2.4.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the edit action to wp-admin/admin.php...

CVE-2014-5184

SQL injection vulnerability in the stripshow-storylines page in the stripShow plugin 2.5.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the story parameter in an edit action to wp-admin/admin.php...

CVE-2014-5089

SQL injection vulnerability in admin/options/logs.php in Status2k allows remote authenticated administrators to execute arbitrary SQL commands via the log parameter...

CVE-2014-5090

admin/options/logs.php in Status2k allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the Location field in Add Logs in the Admin Panel...

CVE-2014-5089

Status2k Server Monitoring Software (Status2K) is affected by CVE-2014-5089 due to an SQL injection in admin/options/logs.php where the log parameter can be exploited by remote authenticated administrators to execute arbitrary SQL commands. This is supported by multiple sources (NVD entry CVE-201...

WordPress StripShow Plugin <= 2.5.2 - SQL Injection

Because of this vulnerability in the stripshow-storylines page, remote authenticated administrators can execute arbitrary SQL commands in an edit action to wp-admin/admin.php via the "story" parameter. Solution Update the plugin...

Oracle Password Auditor - Oracle Password Recovery & Auditing Tool

Oracle Password Auditor is the FREE Oracle database password recovery and auditing software. It not only helps you to recover lost or forgotten Oracle database password but also audit Oracle database setup in an corporate environment by discovering the weak password configurations. During auditin...

Microsoft Releases EMET 5.0 Exploit Mitigation Tool

The latest version of Microsoft’s freely available stopgap against zero-day exploits was released today with two new exploit mitigations and a batch of new configuration options. The update to Microsoft’s Enhanced Mitigation Experience Tool kit, or EMET, comes six months after a technical preview...

CVE-2014-2974

Cross-site request forgery CSRF vulnerability in php/useraccount.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts...

CVE-2014-2974

Cross-site request forgery CSRF vulnerability in php/useraccount.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts...

openstack-horizon: multiple XSS flaws

A cross-site scripting XSS flaw was found in the way orchestration templates were handled. An owner of such a template could use this flaw to perform XSS attacks against other Horizon users. CVE-2014-3473 It was found that network names were not sanitized. A malicious user could use this flaw to...