6: JSM policy not respected by deployed applications

It was found that Java Security Manager permissions configured via a policy file were not properly applied, causing all deployed applications to be granted the java.security.AllPermission permission. In certain cases, an attacker could use this flaw to circumvent expected security measures to...

CVE-2014-5938

CVE-2014-5938 affects the AllDealsAsia All Deals ADA Android app (package com.ada.deals) version 4.2.1. The app does not verify X.509 certificates when connecting to SSL servers, enabling potential MITM attackers to spoof servers and access sensitive data via a crafted certificate. No remediation...

CVE-2014-5938: Undefined Security Weakness

The AllDealsAsia All Deals ADA app aka com.ada.deals application 4.2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Retrieving all tables and their columns at once MSSQL

In the Name of ALLAH the Most Beneficent and the Merciful Zenodermus, Ch3rn0by1 and Me was workinn on MSSQL.. when Zenodermus thought to make a DIOS for MSSQL.. previously at Код: http://websec.ca/kb/sqlinjection DIOS is under the heading Retrieving Multiple Tables and Columns Код: AND 1=0; BEGIN...

MEHR Automation System Arbitrary File Download Vulnerability(persian portal)

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Title : MEHR Automation System Arbitrary File Download Vulnerabilitypersian portal Author : alieye vendor : http://shakhesrayane.ir/ Contact : [email protected] Risk : High Class: Remote Google Dork: intext:"[email protected]"...

WordPress All In One SEO Pack 2.2.2 Cross Site Scripting

Author: 1N3 Website: http://xerosecurity.com Vendor Website: https://wordpress.org/plugins/all-in-one-seo-pack/ Affected Product: All In One SEO Pack Affected Version: 2.2.2 ABOUT: All in One SEO Pack is a WordPress SEO plugin to automatically optimize your WordPress blog for Search Engines such ...

CVE-2014-5186

SQL injection vulnerability in the All Video Gallery all-video-gallery plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an edit action in the allvideogalleryvideos page to wp-admin/admin.php...

CVE-2012-6653

Unspecified vulnerability in the All Video Gallery all-video-gallery plugin before 1.2.0 for WordPress has unspecified impact and attack vectors...

Sql injection

SQL injection vulnerability in the All Video Gallery all-video-gallery plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an edit action in the allvideogalleryvideos page to wp-admin/admin.php...

Design/Logic Flaw

Unspecified vulnerability in the All Video Gallery all-video-gallery plugin before 1.2.0 for WordPress has unspecified impact and attack vectors...

CVE-2014-5186

SQL injection vulnerability in the All Video Gallery all-video-gallery plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an edit action in the allvideogalleryvideos page to wp-admin/admin.php...

CVE-2012-6653

Unspecified vulnerability in the All Video Gallery all-video-gallery plugin before 1.2.0 for WordPress has unspecified impact and attack vectors...

CVE-2012-6653

CVE-2012-6653 affects the All Video Gallery WordPress plugin prior to 1.2.0. The vulnerability is an SQL Injection in the plugin’s config.php handling (multiple parameters), which can allow data modification and unauthorized access if exploited. Affected product: WordPress All Video Gallery plugi...

CVE-2014-5186

The All Video Gallery (WordPress) plugin 1.2 is affected by CVE-2014-5186 through an SQL injection in the id parameter of the allvideogallery_videos edit action (wp-admin/admin.php). Remote authenticated administrators can execute arbitrary SQL commands. Remediation guidance from connected source...

CVE-2012-6653: Undefined Security Weakness

Unspecified vulnerability in the All Video Gallery all-video-gallery plugin before 1.2.0 for WordPress has unspecified impact and attack vectors...

PT-2014-2418

Name of the Vulnerable Software and Affected Versions All Video Gallery plugin versions prior to 1.2.0 Description The issue affects the All Video Gallery plugin for WordPress, with an unspecified impact and attack vectors. Recommendations For versions prior to 1.2.0, update to version 1.2.0 or...

CVE-2014-5186: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the All Video Gallery all-video-gallery plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an edit action in the allvideogalleryvideos page to wp-admin/admin.php...

PT-2014-6325

Name of the Vulnerable Software and Affected Versions All Video Gallery plugin version 1.2 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the id parameter in an edit action in the "allvideogallery videos" page to...

All in One Adsense YPN 2.0.1 - all-in-one-adsense-&-ypn.php Direct Request AdSense Account Manipulation

The all-in-one-adsense-and-ypn WordPress plugin was affected by an all-in-one-adsense-&-ypn.php Direct Request AdSense Account Manipulation security vulnerability...

Joomla Component Card View JX XSS Vulnerabilities

No description provided by source. :::::::::::::::::::::::::::::::::::::: 0x1 :::::::::::::::::::::::::::::::::::::: General Information Advisory/Exploit Title = Joomla Component Card View JX XSS Vulnerabilities Author = Valentin Hoebel Contact = [email protected]...