1641 matches found
CVE-2015-6535: Stored XSS in YouTube Embed (WordPress plugin) allows admins to compromise super admins
Details ================ Software: YouTube Embed Version: 3.3.2 Homepage: https://wordpress.org/plugins/youtube-embed/ CVE ID: CVE-2015-6535 Pending CWE ID: CWE-79 CVSS: 5.5 Medium; AV:N/AC:L/Au:S/C:P/I:P/A:N Description ================ A stored XSS vulnerability in YouTube Embed 3.3.2 and...
October 2015 Oracle Critical Patch Update
Oracle on Tuesday patched 154 vulnerabilities in 54 different products as part of its regularly scheduled Critical Patch Update. More than half of the patches, 84 to be exact, address vulnerabilities that Oracle claims may be remotely exploitable without authentication. Java SE is responsible for...
Bugzilla Privilege Escalation Security Patch
Developers and organizations that use the Bugzilla open source bug-tracking system should upgrade to current versions after the disclosure of details of a vulnerability in its email-based permissions process. The flaw, CVE-2015-4499, was patched last week in versions 4.2.15, 4.4.10 and 5.0.1 afte...
WordPress YouTube Embed 3.3.2 Cross Site Scripting Vulnerability
WordPress YouTube Embed plugin version 3.3.2 suffers from a stored cross site scripting vulnerability. Details ================ Software: YouTube Embed Version: 3.3.2 Homepage: https://wordpress.org/plugins/youtube-embed/ CVE ID: CVE-2015-6535 Pending CWE ID: CWE-79 CVSS: 5.5 Medium;...
WordPress YouTube Embed 3.3.2 Cross Site Scripting
Details ================ Software: YouTube Embed Version: 3.3.2 Homepage: https://wordpress.org/plugins/youtube-embed/ CVE ID: CVE-2015-6535 Pending CWE ID: CWE-79 CVSS: 5.5 Medium; AV:N/AC:L/Au:S/C:P/I:P/A:N Description ================ A stored XSS vulnerability in YouTube Embed 3.3.2 and...
CredCrack - Fast and Stealthy Credential Harvester
CredCrack is a fast and stealthy credential harvester. It exfiltrates credentials recusively in memory and in the clear. Upon completion, CredCrack will parse and output the credentials while identifying any domain administrators obtained. CredCrack also comes with the ability to list and enumera...
WordPress Crontrol Plugin <= 1.2.3 - Cross Site Scripting (XSS)
Because of this vulnerability, authenticated administrators can store HTML and JS code. Vulnerable parameters: "idhookname", "idsig", "idnextrun", "idargscode". Solution Update the plugin...
CollabNet Subversion Edge indes local file inclusion
Vuln Title: Local file inclusion in CollabNet Subversion Edge Management Frontend via logfile "listViewItem" parameter of the "index" action Date: 28.06.2015 Author: otr Software Link: https://www.open.collab.net/downloads/svnedge Vendor: CollabNet Version: 4.0.11 Tested on: Fedora Linux Type:...
PT-2015-6668
Name of the Vulnerable Software and Affected Versions FiverrScript version 7.2 Description A cross-site request forgery issue allows remote attackers to hijack administrator authentication for requests that create a new admin via a request to "administrator/admins create.php". Recommendations For...
PT-2015-5346
Name of the Vulnerable Software and Affected Versions Aruba Networks ClearPass Policy Manager versions prior to 6.4.4 Description A directory traversal issue allows remote administrators to read arbitrary files. Recommendations For versions prior to 6.4.4, update to version 6.4.4 or later to...
WordPress WP Fast Cache Plugin <= 1.4 - Multiple Vulnerabilities
This plugin is prone to cross site request forgery attacks, which can also be combined with XSS attacks authenticated administrators only. Solution Update the plugin...
Shopify: [persistent cross-site scripting] customers can target admins
hello, Let's say a shop has a checkout button. when we click buy now , you will be redirected to https://madamcury.myshopify.com/cart/1188733065:1?channel=buybutton&referer=javascript:alertdocument.cookie; Keep an eye on referer parameter in URL referer=javascript:alertdocument.cookie; A customer...
Http debug commands in FortiMail exposes users credentials to admins
...
CVE-2015-0985
The CVE-2015-0985 entry concerns the XZERES 442SR Wind Turbine OS. The vulnerability is a Cross-Site Request Forgery (CSRF) in the 442SR Web interface that can allow an attacker to hijack an admin’s session and perform actions such as changing the default admin password via a crafted GET request....
Websense TRITON V-Series appliances Arbitrary File Read Information Disclosure Vulnerability
Websense TRITON is the Unified Content Architecture for data security. A security vulnerability in versions prior to Websense TRITON V-Series appliances 7.8.3 hotfix 03 and 7.8.4 hotfix 01 allows remote administrators to read arbitrary files and password information...
Mobile Android, iOS Apps Still Vulnerable to FREAK Attacks
In the shadow of a major OpenSSL vulnerability scheduled to be announced tomorrow, lingering issues remain with mobile platforms and applications that still run versions of the crypto library vulnerable to FREAK attacks. A report published Tuesday by FireEye paints a bleak picture of vulnerable...
SolarWinds Orion Service - SQL Injection
I found a couple SQL injection vulnerabilities in the core Orion service used in most of the Solarwinds products SAM, IPAM, NPM, NCM, etc…. This service provides a consistent configuration and authentication layer across the products. To be exact, the vulnerable applications and versions are:...
CVE-2015-0580
Multiple SQL injection vulnerabilities in the ACS View reporting interface pages in Cisco Secure Access Control System ACS before 5.5 patch 7 allow remote authenticated administrators to execute arbitrary SQL commands via crafted HTTPS requests, aka Bug ID CSCuq79027...
Ghost glibc Vulnerability Affects Enterprise Applications
What drove IT admins crazy about the Bash vulnerability was that it was difficult to determine—and patch—everything that was making a Bash call. It was everywhere. Apparently, some of that angst applies to the Ghost vulnerability in the GNU C library, known as glibc. At first, experts believed th...
