WordPress Comment Rating Plugin 2.9.32 - Multiple Vulnerabilities

This Comment Rating plugin is prone to multiple vulnerabilities such as comment rating SQL injection and BYPASS. Solution Update the plugin...

WordPress Plugin Comment Rating 2.9.32 - Multiple Vulnerabilities

WordPress Plugin Comment Rating 2.9.32 - Multiple Vulnerabilities Exploit Title: Wordpress plugin: Comment Rating SQL injection Google Dork: Date: 21/02/2013 Exploit Author: ebanyu Url Author: www.ebanyu.com.ar Vendor Homepage: wealthynetizen.com Software Link:...

Chinese malware campaign 'Beebus' target US defense industries

A Chinese malware campaign called 'Beebus' specifically targeting the aerospace and defense industries has been uncovered by FireEye security researchers. Beebus is designed to steal information, and begins its infiltration, as so many attacks do, with spear-phishing emails. Operation Beebus very...

PT-2013-1987

Name of the Vulnerable Software and Affected Versions w-CMS version 2.01 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the p parameter in the getMenus function in codes/wcms.php, or the COMMENT parameter in blog.php, guestbook.php, ...

CVE-2012-6101

Multiple open redirect vulnerabilities in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors related to 1 backup/backupfilesedit.php, 2 comment/commentpost.php, 3...

CVE-2012-6101

Multiple open redirect vulnerabilities in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors related to 1 backup/backupfilesedit.php, 2 comment/commentpost.php, 3...

CVE-2012-6101

Multiple open redirect vulnerabilities in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors related to 1 backup/backupfilesedit.php, 2 comment/commentpost.php, 3...

CVE-2012-6101

Multiple open redirect vulnerabilities in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors related to 1 backup/backupfilesedit.php, 2 comment/commentpost.php, 3...

ThinkSNS V3任意删除评论 微博 转发漏洞

简要描述： 今天注册的v3测试下功能 发现v3问题很多 主要是在没有验证权限，只是单纯的在js上进行验证，下面是测试截图。 详细说明： 删除前： 删除中 修改uid和微博id 删除后： 漏洞证明：...

PT-2013-1891

Name of the Vulnerable Software and Affected Versions Moodle versions 2.2.x through 2.2.6 Moodle versions 2.3.x through 2.3.3 Moodle versions 2.4.x through 2.4.0 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved v...

CVE-2012-6101: Improper Input Validation

Multiple open redirect vulnerabilities in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors related to 1 backup/backupfilesedit.php, 2 comment/commentpost.php, 3...

Joomla Component com_jooproperty Sql Injection / Xss Vulnerability

JooProperty is a real estate component developed for Joomla 1.7 and 2.5 with complex integrated booking features, price calculation for different seasons and comment and rating functions. The component is based on com-property for Joomla 1.5 of Fabio Ueltzinger and offers the possibility to impor...

CVE-2012-4470

The Listhandler module 6.x-1.x before 6.x-1.1 for Drupal does not properly check permissions when importing emails, which allows remote comment authors to bypass access restrictions and possibly have other unspecified impact...

CVE-2012-4470

The vulnerability CVE-2012-4470 affects the Listhandler module for Drupal (versions 6.x-1.x prior to 6.x-1.1). The root cause is an improper permissions check when importing emails, allowing remote comment authors to bypass access restrictions. This could enable unintended access or other unspeci...

CVE-2012-2438

ar web content manager AWCM 2.2 does not restrict the number of comment records that can be submitted through HTTP requests, which allows remote attackers to cause a denial of service disk consumption via the coment parameter to 1 showvideo.php or 2 topic.php...

Code injection

ar web content manager AWCM 2.2 does not restrict the number of comment records that can be submitted through HTTP requests, which allows remote attackers to cause a denial of service disk consumption via the coment parameter to 1 showvideo.php or 2 topic.php...

CVE-2012-2438

ar web content manager AWCM 2.2 does not restrict the number of comment records that can be submitted through HTTP requests, which allows remote attackers to cause a denial of service disk consumption via the coment parameter to 1 showvideo.php or 2 topic.php...

PT-2012-4044

Name of the Vulnerable Software and Affected Versions ar web content manager AWCM version 2.2 Description The issue allows remote attackers to cause a denial of service due to disk consumption. This can be achieved by submitting a large number of comment records through HTTP requests to specific...

Facebook Proposes Eliminating User Voting System for Privacy Changes

Facebook today announced plans to eliminate its voting system that gave users a say in how their privacy is handled. In a statement issued Wednesday, Elliot Schrage, Vice President, Communications, Public Policy and Marketing for the Menlo Park, Calif.-based social media company, said the voting...

AWCM 2.2 Access Bypass Vulnerability

AWCM version 2.2 appears to suffer from cookie forgery and direct access vulnerabilities. Vulnerability Report AWCM 2.2 CVE-Candidate-ID: CVE-2012-2437, CVE-2012-2438 Issue: Access Control Bug in AWCM 2.2, Anyone can build the cookie and inserts DB records. Author: Sooel Son sonpostman at gmail d...