W-Agora 4.1.6 EditForm.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6464/info W-Agora is a freely available, open source PHP forum software package. It is available for Unix and Linux systems. A problem with W-Agora may make cross-site scripting attacks possible. It has been reported that...

LedNews 0.7 Post Script Code Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7920/info It has been reported that LedNews does not properly filter input from news posts. Because of this, it may be possible for an attacker to steal authentication cookies or perform other nefarious activities. script...

WebWasher CSM 4.4.1 Build 752 Conf Script Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13037/info It is reported that the WebWasher 'conf' script is prone to a cross-site scripting vulnerability. A remote attacker may exploit this issue to have arbitrary script and HTML code executed in the browser of a...

Naxtor E-directory 1.0 Message.ASP Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14468/info Naxtor E-directory is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this vulnerability to...

Jetty 4.1 Servlet Engine Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5821/info Jetty is a freely available, open source Java Web Server and Servlet Container. It is available for Linux, Unix, and Microsoft Windows platforms. It has been reported that Jetty does not properly sanitize...

phpMyAdmin 2.x queryframe.php XSS

No description provided by source. source: http://www.securityfocus.com/bid/15196/info phpMyAdmin is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have...

MGASA-2014-0254 Updated wordpress package fixes multiple vulnerabilities

Updated wordpress package fixes security vulnerabilities: WordPress before 3.7.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php CVE-2014-0165. The wpvalidateauthcookie...

Updated wordpress package fixes multiple vulnerabilities

Updated wordpress package fixes security vulnerabilities: WordPress before 3.7.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php CVE-2014-0165. The wpvalidateauthcookie...

WordPress Cookie Flaw Lets Hackers Hijack Your Account

Do you own a blog on WordPress.com website? If Yes, then you should take some extra cautious while signing into your Wordpress account from the next time when connected to public Wi-Fi, because it can be hacked without your knowledge, even if you have enabled two-factor authentication. Yan Zhu, a...

IBM WebSphere Portal 7.0.0.x < 7.0.0.2 CF28 Multiple Vulnerabilities

The version of IBM WebSphere Portal installed on the remote host is affected by multiple vulnerabilities : - An unspecified denial of service vulnerability exists that allows a remote attacker to crash the host by sending a specially crafted web request. CVE-2014-0949 - A cross-site scripting XSS...

IBM WebSphere Portal 'FilterForm.jsp' XSS (PI15690)

The version of IBM WebSphere Portal on the remote host is affected by a cross-site scripting vulnerability in the 'FilterForm.jsp' script due to improper user input validation. An attacker can exploit this issue to execute code in the security context of a user's browser to steal authentication...

IBM WebSphere Portal 'boot_config.jsp' XSS (PI16041)

The version of IBM WebSphere Portal on the remote host is affected by a cross-site scripting vulnerability in the 'bootconfig.jsp' script due to improper user input validation. An attacker could exploit this issue to execute code in the security context of a user's browser to steal authentication...

Mandriva Linux Security Advisory : wordpress (MDVSA-2014:103)

Multiple vulnerabilities has been discovered and corrected in wordpress : WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php...

Hijacked authentication cookies vulnerability

More info at https://laravel.com/docs/5.1/upgradeupgrade-4.1.26...

Hijacked authentication cookies vulnerability

More info at https://laravel.com/docs/5.3/upgradeupgrade-4.1.26...

Debian DSA-2901-1 : wordpress - security update

Several vulnerabilities were discovered in Wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2014-0165 A user with a contributor role, using a specially crafted request, can publish posts, which is reserved for users of the...

DSA-2901-1 wordpress - security update

Bulletin has no description...

CVE-2014-0166

The wpvalidateauthcookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie...

Authentication flaw

The wpvalidateauthcookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie...

CVE-2014-0166

CVE-2014-0166 concerns WordPress: the wp_validate_auth_cookie function in wp-includes/pluggable.php failed to correctly verify authentication cookies, enabling remote access via forged cookies. Affected were WordPress releases prior to 3.7.2 and 3.8.x prior to 3.8.2. OpenVAS/Mageia and Fedora adv...