2103 matches found
CVE-2014-3850
Cross-site request forgery CSRF vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable registration approval via a request to...
CVE-2014-3850
CVE-2014-3850 affects the WordPress Member Approval plugin (version 131109). The vulnerability is a Cross-Site Request Forgery (CSRF) that allows an attacker to hijack an administrator’s session and reset the plugin settings to defaults, effectively disabling registration approval via wp-admin/op...
WordPress Member Approval Cross Site Request Forgery
Details ================ Software: Member Approval Version: 131109 Homepage: http://wordpress.org/plugins/member-approval/ Advisory ID: dxw-1970-1172 CVE: CVE-2014-3850 CVSS: 5.8 Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N Description ================ CSRF in Member Approval 131109 permits unapproved...
某政府行政审批系统咨询处sql注入漏洞
简要描述： 女神是什么？ 详细说明： 关键词 inurl:/OnlineQuery/QueryDetail.aspx? 关键词仅供参考 部分网站不存在注入， 可能是版本的原因。 举几个例子 注入地址:http://shenpi.yuzhou.gov.cn/OnlineQuery/QueryDetail.aspx?QueryId=487 sqlmap/1.0-dev - automatic SQL injection and database takeover tool http://www.sqlmap.org ! legal disclaimer: usage of sqlmap fo...
WordPress Member Approval Plugin <= 131109 - CSRF
Cross-site request forgery CSRF vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable registration approval via a request to...
Localize: XSS in invite approval
If a translator's name is set as “ and requests to join a project, and the project admin clicks on the review to accept it, it results in an xss. Screen: attacker/translator: http://prntscr.com/3ax1ca contributor/admin: http://prntscr.com/3ax1ix...
Localize: XSS & HTML injection
Link: http://www.localize.io/review/3C/languages/3 while approving and reviewing a phrase, you are able to send/set a message. You can XSS that by entering an XSS string String used: ? Screenshot: http://prntscr.com/3awo2p...
NSA Surveillance Reform Demonstrate Need for Public Scrutiny
The Snowden leaks and the ensuing critical spotlight shone on the National Security Agency’s surveillance programs have nudged many technologists, privacy hounds and politicians away from their desks and onto the front lines calling for reforms. Two nights ago, the New York Times reported that...
French intelligence agency gets complete access to Orange Telecom Data
Another leak from Edward Snowden files, but this time not about the NSA, rather the documents revealed that France's central intelligence agency, the DGSE has complete and unconditional access to all of telecom giant Orange’s data, not just metadata. Yes! It is the same Orange company who...
Discuz某处XSS劫持UC_KEY（XSS应用详细过程）
简要描述： Discuz某处XSS劫持UCKEY到拿webshell。 XSS应用的详细过程。 详细说明： 漏洞： 这个漏洞的位置在Discuz的门户功能处。 在发表文章时，打开“编辑源码”功能时，写入任意XSS CODE后，再进入和输出都没有过滤。导致存储型XSS。 大家都知道，这里的XSS虽然可以劫持到用户和管理的Cookies，但是没什么用，无法登陆。 那么，我们可以想办法拿XSS来干点其他的，比如劫持管理员后台内容，如UCKEY等。 门槛： 因为默认安装情况下这个门户功能是没有配置的。 所以管理员需要手动配置门户功能。大部分都会开启门户。...
Obama Orders NSA Bulk Metadata Surveillance Reforms
President Obama today announced reforms to the National Security Agency’s bulk metadata collection program under Section 215 of the PATRIOT Act, ordering a transition that would end the program as it exists today, and prohibit the government from storing and accessing the data without secret cour...
CVE-2013-6972
Cisco WebEx Training Center allows remote attackers to discover session numbers, and bypass host approval for audio-conference attendance, by reading HTML source code, aka Bug ID CSCul57126...
Authentication flaw
Cisco WebEx Training Center allows remote attackers to discover session numbers, and bypass host approval for audio-conference attendance, by reading HTML source code, aka Bug ID CSCul57126...
CVE-2013-6972
Cisco WebEx Training Center exposes session numbers via server HTML responses, allowing remote attackers to discover valid session numbers and bypass host approval to join audio-conferences without attendee authorization. Root cause: inappropriate disclosure of sensitive information in server rep...
CVE-2013-6972
Cisco WebEx Training Center allows remote attackers to discover session numbers, and bypass host approval for audio-conference attendance, by reading HTML source code, aka Bug ID CSCul57126...
[iBliss Security Advisory] Cross-Site Scripting (XSS) vulnerability in Design-approval-system wordpress plugin
Design-Approval-System Wordpress plugin XSS vendor product description A system to streamline the process of getting designs, photos, documents, videos or music approved by clients quickly. Bug Description The walkthrouth web page does not validate the step parameter leading to a Cross-site...
CVE-2013-2269
The Sponsorship Confirmation functionality in Aruba Networks ClearPass 5.x, 6.0.1, and 6.0.2, and Amigopod/ClearPass Guest 3.0 through 3.9.7, allows remote attackers to bypass intended access restrictions and approve a request by sending a guest request, then using "parameter manipulation" in...
CVE-2013-2269
The Sponsorship Confirmation functionality in Aruba Networks ClearPass 5.x, 6.0.1, and 6.0.2, and Amigopod/ClearPass Guest 3.0 through 3.9.7, allows remote attackers to bypass intended access restrictions and approve a request by sending a guest request, then using "parameter manipulation" in...
CVE-2013-5149
The CVE-2013-5149 affect Apple iOS prior to 7.0, where the push-notification token could be disclosed to an app during registration without user consent. Root cause: token access was granted before user approval. Impact: potential information disclosure via apps. Mitigation: upgrade to iOS 7.0 or...
CVE-2013-5711
Cross-site scripting XSS vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System plugin before 3.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter...