Authentication flaw

The SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to bypass authentication and read or write to arbitrary database fields via unspecified vectors...

CVE-2015-0981

The SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to bypass authentication and read or write to arbitrary database fields via unspecified vectors...

Django Cross-Site Scripting Vulnerability (CNVD-2015-01672)

Django is Django Software Foundation of an open source Web application framework using the Python language . The framework includes an object-oriented mapper, view system, template system and so on. A cross-site scripting vulnerability exists in the 'contents' function in the admin/helpers.py fil...

DEBIAN-CVE-2015-2241

Cross-site scripting XSS vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonlyfields, as demonstrated by a @property...

PYSEC-2015-8

Cross-site scripting XSS vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonlyfields, as demonstrated by a @property...

IBM Rational ClearQuest 7.1.1.x < 7.1.1.4 / 7.1.2.x < 7.1.2.1 Multiple Vulnerabilities (credentialed check)

The remote host is running a version of IBM Rational ClearQuest 7.1.1.x prior to 7.1.1.4 / 7.1.2.x prior to 7.1.2.1 installed. It is, therefore, affected by the following vulnerabilities : - An information disclosure vulnerability exists in the Dojo Toolkit that allows a remote attacker to read...

CVE-2015-1223

Multiple use-after-free vulnerabilities in core/html/HTMLInputElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger extraneous change...

Cisco IOS and IOS XE RADIUS Implementation Denial of Service Vulnerability

Cisco IOS and IOS-XE are both operating systems developed by Cisco for its network devices. A security vulnerability exists in the RADIUS implementation of Cisco IOS and IOS XE. A remote attacker could exploit this vulnerability to cause a denial of service device reload with the help of speciall...

WordPress Calculated Fields Form 1.0.10 SQL Injection Vulnerability

WordPress Calculated Fields Form plugin versions 1.0.10 and below suffer from a remote SQL injection vulnerability. + Calculated Fields Form Wordpress Plugin = 1.0.10 - Remote SQL Injection Vulnerability + Author: Ibrahim Raafat + Twitter: https://twitter.com/RaafatSEC + Plugin:...

WordPress Plugin Calculated Fields Form 1.0.10 - SQL Injection

WordPress Plugin Calculated Fields Form 1.0.10 - SQL Injection + Calculated Fields Form Wordpress Plugin = 1.0.10 - Remote SQL Injection Vulnerability + Author: Ibrahim Raafat + Twitter: https://twitter.com/RaafatSEC + Plugin: https://wordpress.org/plugins/calculated-fields-form/ + TimeLine - Feb...

WordPress Calculated Fields Form Plugin <= 1.0.10 - Remote SQL Injection

Calculated Fields Form plugin is prone to a remote SQL injection vulnerability that allows an attacker to execute SQL queries into database. Solution Upgrade the plugin...

WordPress Calculated Fields Form 1.0.10 SQL Injection

Calculated Fields Form Wordpress Plugin = 1.0.10 - Remote SQL Injection Vulnerability + Author: Ibrahim Raafat + Twitter: https://twitter.com/RaafatSEC + Plugin: https://wordpress.org/plugins/calculated-fields-form/ + TimeLine - Feb 6 2015, The vulnerabilities reported - Feb 7 2015, Response and...

WordPress Plugin Calculated Fields Form 1.0.10 - SQL Injection

Calculated Fields Form Wordpress Plugin = 1.0.10 - Remote SQL Injection Vulnerability + Author: Ibrahim Raafat + Twitter: https://twitter.com/RaafatSEC + Plugin: https://wordpress.org/plugins/calculated-fields-form/ + TimeLine - Feb 6 2015, The vulnerabilities reported - Feb 7 2015, Response and...

CVE-2015-2083

Cross-site request forgery CSRF vulnerability in Ilch CMS allows remote attackers to hijack the authentication of administrators for requests that add a value to a profile field via a profilefields request to admin.php...

CVE-2015-2083

Cross-site request forgery CSRF vulnerability in Ilch CMS allows remote attackers to hijack the authentication of administrators for requests that add a value to a profile field via a profilefields request to admin.php...

USN-2497-1: NTP vulnerabilities

Stephen Roettger, Sebastian Krahmer, and Harlan Stenn discovered that NTP incorrectly handled the length value in extension fields. A remote attacker could use this issue to possibly obtain leaked information, or cause the NTP daemon to crash, resulting in a denial of service. CVE-2014-9297 Steph...

Multiple Cross-Site Request Forgery Vulnerabilities in Drupal Contact Form Fields

Drupal is a free and open source content management system developed in PHP. Multiple cross-site request forgery vulnerabilities exist in Drupal Contact Form Fields, which can be exploited by an attacker to perform certain unauthorized actions and gain access to affected applications...

SA-CONTRIB-2015-020 - Contact Form Fields - Cross Site Request Forgery (CSRF)

The Contact Form Fields module enables you to create additional fields to site-wide contact form. Some links were not properly protected from CSRF. A malicious user could cause an administrator to delete fields by getting the administrator's browser to make a request to a specially-crafted URL...

SA-CONTRIB-2015-022 - nodeauthor - Cross Site Scripting (XSS) - Unsupported

This module displays node author information in a jQuery slider. The module doesn't sufficiently sanitize Profile2 fields in a provided block. This vulnerability is mitigated by the fact that an attacker must have a user account allowed to edit profile fields. CVE identifiers issued CVE-2015-3365...

CVE-2014-9346

Multiple cross-site scripting XSS vulnerabilities in the Hierarchical Select module 6.x-3.x before 6.x-3.9 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to the 1 taxonomy term title for instances with Save term...