Design/Logic Flaw

FortiGuard FortiAuthenticator before 3.0 allows remote administrators to gain privileges via the command line interface...

CVE-2013-6990

FortiAuthenticator before version 3.0 is affected by CVE-2013-6990, a privilege-escalation flaw that lets remote administrators gain root-level access via the command-line interface. The issue is discussed in Fortinet FG-IR-13-016 and is echoed by multiple vulnerability reports describing a subsh...

CVE-2013-6990

FortiGuard FortiAuthenticator before 3.0 allows remote administrators to gain privileges via the command line interface...

CVE-2013-7064

Cross-site scripting XSS vulnerability in the EU Cookie Compliance module 7.x-1.x before 7.x-1.12 for Drupal allows remote authenticated administrators with the "Administer EU Cookie Compliance popup" permission to inject arbitrary web script or HTML via unspecified configuration values...

CVE-2013-7064

Cross-site scripting XSS vulnerability in the EU Cookie Compliance module 7.x-1.x before 7.x-1.12 for Drupal allows remote authenticated administrators with the "Administer EU Cookie Compliance popup" permission to inject arbitrary web script or HTML via unspecified configuration values...

CVE-2013-7064

Cross-site scripting XSS vulnerability in the EU Cookie Compliance module 7.x-1.x before 7.x-1.12 for Drupal allows remote authenticated administrators with the "Administer EU Cookie Compliance popup" permission to inject arbitrary web script or HTML via unspecified configuration values...

CVE-2014-2996

XCloner Standalone 3.5 and earlier, when enabledbbackup and sqlmem are enabled, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the dbbackupcomp parameter in a generate action to index2.php. NOTE: it is not clear whether this issue crosses...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of administrators for requests that delete 1 users via admin/agency-user-unlink.php, 2 advertisers via admin/advertiser-delete.php, 3 banners via...

CVE-2013-5954

Multiple cross-site request forgery CSRF vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of administrators for requests that delete 1 users via admin/agency-user-unlink.php, 2 advertisers via admin/advertiser-delete.php, 3 banners via...

Google Releases Security Updates for Chrome

Google has released security updates to address multiple vulnerabilities in Chrome. Some of these vulnerabilities may lead to memory corruption or arbitrary code execution. Updates available include: Chrome 34.0.1847.131 for Windows and Mac. Chrome 34.0.1847.132 for Linux. Chrome 34.0.1847.134 fo...

WordPress Twitget Plugin <= 3.3.2 - Multiple XSS

Because of these vulnerabilities in twitget.php, authenticated administrators can inject arbitrary web script or HTML via unspecified vectors. Solution Update the plugin...

CVE-2014-1990

CVE-2014-1990 corresponds to a cross-site request forgery (CSRF) in Toshiba TEC e‑Studio series TopAccess web management utility (models 232/233/282/283). The root cause is CSRF allowing an attacker to change administrator passwords by tricking a logged-in admin into visiting a malicious page, po...

CVE-2014-1990

Cross-site request forgery CSRF vulnerability in TopAccess aka the web-based management utility on TOSHIBA TEC e-Studio 232, 233, 282, and 283 devices allows remote attackers to hijack the authentication of administrators for requests that change passwords...

Cross site scripting

Cross-site scripting XSS vulnerability in F-Secure Messaging Secure Gateway 7.5.0 before Patch 1862 allows remote authenticated administrators to inject arbitrary web script or HTML via the new parameter in the SysUser module to admin...

CVE-2014-2844

Cross-site scripting XSS vulnerability in F-Secure Messaging Secure Gateway 7.5.0 before Patch 1862 allows remote authenticated administrators to inject arbitrary web script or HTML via the new parameter in the SysUser module to admin...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Dell SonicWALL Email Security 7.4.5 and earlier allow remote authenticated administrators to inject arbitrary web script or HTML via 1 the uploadPatch parameter to the System/Advanced page settingsadvanced.html or 2 the uploadLicenses parameter...

CVE-2014-2879

Multiple cross-site scripting XSS vulnerabilities in Dell SonicWALL Email Security 7.4.5 and earlier allow remote authenticated administrators to inject arbitrary web script or HTML via 1 the uploadPatch parameter to the System/Advanced page settingsadvanced.html or 2 the uploadLicenses parameter...

Adobe Releases Security Update for Reader Mobile

Adobe has released a security update to address a vulnerability in Adobe Reader Mobile 11.1.3 and earlier versions for Android. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary code via a crafted PDF document. US-CERT recommends that users and administrators...

CVE-2014-2850

The network interface configuration page netinterface in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter...

CVE-2013-2699

Cross-site request forgery CSRF vulnerability in the underConstruction plugin before 1.09 for WordPress allows remote attackers to hijack the authentication of administrators for requests that deactivate a plugin via unspecified vectors...