PT-2014-2288

Name of the Vulnerable Software and Affected Versions Zingiri Forum plugin versions prior to 1.4.4 Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the zing forum output function. This is achieved by including a .. dot dot in the...

CVE-2013-0735

Multiple SQL injection vulnerabilities in wpf.class.php in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to execute arbitrary SQL commands via the id parameter in a viewtopic 1 removepost, 2 sticky, or 3 closed action or 4 thread parameter in a postreply action to...

Sql injection

Multiple SQL injection vulnerabilities in wpf.class.php in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to execute arbitrary SQL commands via the id parameter in a viewtopic 1 removepost, 2 sticky, or 3 closed action or 4 thread parameter in a postreply action to...

CVE-2013-0735

Multiple SQL injection vulnerabilities in wpf.class.php in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to execute arbitrary SQL commands via the id parameter in a viewtopic 1 removepost, 2 sticky, or 3 closed action or 4 thread parameter in a postreply action to...

CVE-2013-0735

CVE-2013-0735 affects the WordPress Mingle Forum plugin (pre-1.0.34) via wpf.class.php . The vulnerability is described as multiple SQL injection flaws that allow remote attackers to execute arbitrary SQL commands through the id parameter in actions such as viewtopic (1) remove_post, (2) sticky, ...

CVE-2013-0735: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in wpf.class.php in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to execute arbitrary SQL commands via the id parameter in a viewtopic 1 removepost, 2 sticky, or 3 closed action or 4 thread parameter in a postreply action to...

PT-2014-2461

Name of the Vulnerable Software and Affected Versions Mingle Forum plugin versions prior to 1.0.34 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the id parameter in a viewtopic action, such as remove post, sticky, or closed, or the threa...

CVE-2013-0734

Multiple cross-site scripting XSS vulnerabilities in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 searchwords parameter in a search action to wpf.class.php or 2 togroupusers parameter in an addusertogroup action to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 searchwords parameter in a search action to wpf.class.php or 2 togroupusers parameter in an addusertogroup action to...

CVE-2013-0734

Multiple cross-site scripting XSS vulnerabilities in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 searchwords parameter in a search action to wpf.class.php or 2 togroupusers parameter in an addusertogroup action to...

CVE-2013-0734

Product/Version: Mingle Forum WordPress plugin (pre-1.0.34). Vulnerabilities: Multiple XSS in two parameters: (1) search_words in wpf.class.php; (2) togroupusers in fs-admin/fs-admin.php. Impact: Remote attackers can inject arbitrary web script or HTML. Exploitation context: Noted as XSS vulnerab...

CVE-2013-0734: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 searchwords parameter in a search action to wpf.class.php or 2 togroupusers parameter in an addusertogroup action to...

PT-2014-2460

Name of the Vulnerable Software and Affected Versions Mingle Forum plugin versions prior to 1.0.34 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the search words parameter in a search action to "wpf.class.php" or the togroupusers...

Full Disclosure List Rises From the Ashes For Fresh Start

When the Full Disclosure mailing list closed down last week, many in the security community wondered what, if anything, would fill the void. As it turns out, Full Disclosure will fill that void. John Cartwright, one of the creators of the list, announced on March 19 that he was shutting it down...

Code injection

The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/overrideform.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain...

CVE-2014-0124

The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/overrideform.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain...

CVE-2014-0124

The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/overrideform.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain...

CVE-2014-0124

The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/overrideform.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain...

CVE-2014-0124

The vulnerability CVE-2014-0124 affects Moodle: identity-reporting in mod/forum/renderer.php and mod/quiz/override_form.php allows remote authenticated users to see e-mail addresses. Affected versions include Moodle up to 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2. Imp...

CVE-2014-0124: Undefined Security Weakness

The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/overrideform.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain...