WP 插件 NEX-Forms Lite 2.1.0 XSS 漏洞

1.漏洞分析 由于下不到2.1.0的源代码，只能根据漏洞描述以及3.4版本的代码进行推敲。 先看wp-admin/admin-ajax.php文件 wp-admin/admin-ajax.php:77 php if isuserloggedin / Fires authenticated AJAX actions for logged-in users. The dynamic portion of the hook name, $REQUEST'action', refers to the name of the AJAX action callback being fired...

WordPress NEX-Forms Lite Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . NEX-Forms Lite is one of the user-defined plugin to create forms . A cross-site scripting vulnerability exists in...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the formfields parameter in a 1 doedit or 2 doinsert action to wp-admin/admin-ajax.php...

MS15-080: Description of the security update for Windows: August 11, 2015

None None...

Chrome Autofill Viewer - Tool to View or Delete Autocomplete data from Google Chrome browser

Chrome Autofill Viewer is the free tool to easily see and delete all your autocomplete data from Google Chrome browser. Chrome stores Autofill entries typically form fields such as login name, pin, passwords, email, address, phone, credit/debit card number, search history etc in an internal...

CVE-2015-3363

Cross-site request forgery CSRF vulnerability in the Contact Form Fields module before 6.x-2.3 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete fields via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Contact Form Fields module before 6.x-2.3 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete fields via unspecified vectors...

CVE-2015-3363

Cross-site request forgery CSRF vulnerability in the Contact Form Fields module before 6.x-2.3 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete fields via unspecified vectors...

CVE-2015-3363

CVE-2015-3363 is a CSRF vulnerability in the Drupal Contact Form Fields module prior to 6.x-2.3. It allows an attacker to trick an authenticated administrator into performing actions (notably deleting fields) on behalf of the admin, via unspecified vectors. Affected versions are all before 6.x-2....

Multiple Cross-Site Request Forgery Vulnerabilities in Drupal Contact Form Fields

Drupal is a free and open source content management system developed in PHP. Multiple cross-site request forgery vulnerabilities exist in Drupal Contact Form Fields, which can be exploited by an attacker to perform certain unauthorized actions and gain access to affected applications...

SA-CONTRIB-2015-020 - Contact Form Fields - Cross Site Request Forgery (CSRF)

The Contact Form Fields module enables you to create additional fields to site-wide contact form. Some links were not properly protected from CSRF. A malicious user could cause an administrator to delete fields by getting the administrator's browser to make a request to a specially-crafted URL...

PHPLinks 2.1.2 Add Site HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6632/info phpLinks is prone to HTML injection. phpLinks does not sufficiently sanitized HTML and script code supplied via form fields before displaying this data to administrative users. This issue exists in the 'add.php'...

Cyclope Employee Surveillance Solution 6.0 6.1.0 6.2.0 - Multiple Vulnerabilities

No description provided by source. Author: loneferret of Offensive Security Product: Cyclope Employee Surveillance Solution v6.0 Version: 6.1.0 & 6.2.0 Vendor Site: http://www.cyclope-series.com/ Software Download: http://www.cyclope-series.com/download/index.html Software description: The employ...

PYSEC-2014-110

Multiple cross-site scripting XSS vulnerabilities in apps/common/templates/calculateformtitle.html in Mayan EDMS 0.13 allow remote authenticated users to inject arbitrary web script or HTML via a 1 tag or the 2 title of a source in a Staging folder, 3 Name field in a bootstrap setup, or Title fie...

WordPress SS Downloads Cross Site Scripting

Exploit Title : Wordpress SS Downloads Plugin Cross Site Scripting Exploit Author : ACC3SS Vendor Homepage : http://wordpress.org/plugins/ss-downloads/developers/ Software Link : http://downloads.wordpress.org/plugin/ss-downloads.1.4.4.1.zip Date : 2014-01-19 Tested on : Windows 7 / Mozilla Firef...

CVE-2013-5227

Apple Safari before 6.1.1 and 7.x before 7.0.1 allows remote attackers to bypass the Same Origin Policy and discover credentials by triggering autofill of subframe form fields...

CVE-2013-5227

CVE-2013-5227 (Safari autofill origin tracking) affects Apple Safari, where remote attackers could bypass Same Origin Policy and discover credentials by triggering autofill of subframe form fields. The vulnerability is described as: Safari may autofill user names and passwords into a subframe fro...

CVE-2013-5227

Apple Safari before 6.1.1 and 7.x before 7.0.1 allows remote attackers to bypass the Same Origin Policy and discover credentials by triggering autofill of subframe form fields...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in CRU Ditto Forensic FieldStation with firmware 2013Oct15a and earlier allow 1 remote attackers to inject arbitrary web script or HTML via the username parameter in a login or 2 remote authenticated users to inject arbitrary web script or HTML vi...

http-rfi-spider NSE Script

Crawls webservers in search of RFI remote file inclusion vulnerabilities. It tests every form field it finds and every parameter of a URL containing a query. Script Arguments http-rfi-spider.withinhost only spider URLs within the same host. default: true http-rfi-spider.url the url to start...