CVE-2017-16580

CVE-2017-16580 affects Foxit Reader 8.3.2.25013 where the ImageField node in XFA forms mishandles user-supplied data, causing an out-of-bounds/read past end vulnerability. The issue enables remote information disclosure and can be leveraged in conjunction with other flaws to execute code in the p...

WordPress Gravity Forms – Clockwork SMS plugin <=2.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability found by Elias Dimopoulos in WordPress Gravity Forms – Clockwork SMS plugin versions =2.2. Solution Update the WordPress Gravity Forms – Clockwork SMS plugin to the latest available version at least 2.4.0...

CVE-2017-14092

The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain...

HackerOne: HTTP Parameter Pollution using semicolons in iframe element at hackerone.com/careers allows loading external Greenhouse forms

Summary: I noticed that HackerOne career pages loads it's application forms from Greenhouse.io via an iframe. The ghjid parameter value is taken into the iframe element for the token parameter in the iframe URL boards.greenhouse.io. Any html characters are escaped in order to avoid XSS and possib...

Automattic: Improper markup sanitisation in Simplenote Android application.

Description The Simplenote Android application 1.5.6 still allows users to embed fully-fledged forms. html Sign in to Simplenote Please sign in Email Password Remember Me Forgot your password? F246484 A more convincing proof of concept could consist of hiding the form inside several paragraphs o...

RegistrationMagic - Custom Registration Forms <= 3.8.0.4 - Authenticated Reflected XSS

The RegistrationMagic – Custom Registration Forms and User Login WordPress plugin was affected by a Custom Registration Forms = 3.8.0.4 - Authenticated Reflected XSS security vulnerability. GET...

RegistrationMagic - Custom Registration Forms <= 3.8.0.4 - Authenticated SQL Injection

The RegistrationMagic – Custom Registration Forms and User Login WordPress plugin was affected by a Custom Registration Forms = 3.8.0.4 - Authenticated SQL Injection security vulnerability. GET...

SS-2017-010: install.php discloses sensitive data by pre-populating DB credential forms

More info at https://www.silverstripe.org/download/security-releases/ss-2017-010/...

WordPress Smart Marketing SMS and Newsletters Forms plugin <=1.1.1 - Unauthenticated Cross-Site Scripting (XSS) vulnerability

Unauthenticated Cross-Site Scripting XSS vulnerability found in WordPress Smart Marketing SMS and Newsletters Forms plugin versions =1.1.1. Solution 12/07/2017 - we were unable to find a patched version of this plugin. Use with caution or uninstall...

WordPress Smart Marketing SMS And Newsletters Forms 1.1.1 XSS Vulnerability

WordPress Smart Marketing SMS and Newsletters Forms plugin version 1.1.1 suffers from a persistent cross site scripting vulnerability. Vulnerable Smart Marketing SMS and Newsletters Forms 1.1.1 Smart Marketing SMS and Newsletters Forms is prone to a stored cross-site scripting vulnerability becau...

Node feedback - Moderately critical - Access Bypass - SA-CONTRIB-2017-092

This module enables you to set nodes to send feedbacks by personal/site wide contact forms. The module doesn't sufficiently handle the access to nodes whose titles will be shown on contact forms. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Us...

WordPress 3rd-Party Inject Results 0.2 Cross Site Scripting

Class Input Validation Error Remote Yes Credit Ricardo Sanchez Vulnerable Forms: 3rd-Party Inject Results 0.2 Forms: 3rd-Party Inject Results is prone to a stored cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue t...

VK.com: clickjacking в /lead_forms_app.php

Кликджекинг в «Форме сбора заявок». Можно было угнать номер и почту любого человека который нажмет на кнопкуbuton на нашем сайте, я считаю это довольно серьезно, ибо нажать кнопку можно было под любым предлогом, к примеру создав фейковый опрос на нашем сайте, а подтверждением голосования добавить...

WordPress Formidable Forms Plugin Remote Code Execution

A remote code execution vulnerability exists in WordPress Formidable Forms plugin. A remote attacker can upload and execute vulnerable shortcodes via crafted parameters. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

WordPress Breezing Forms 1.2.7.42 Cross Site Scripting Vulnerability

WordPress Breezing Forms plugin version 1.2.7.42 suffers from a cross site scripting vulnerability. Class Input Validation Error Remote Yes Credit Ricardo Sanchez Vulnerable Breezing Forms Plugin 1.2.7.42 Breezing Forms Plugin is prone to a stored cross-site scripting vulnerability because it fai...

WordPress Breezing Forms 1.2.7.42 Cross Site Scripting

Class Input Validation Error Remote Yes Credit Ricardo Sanchez Vulnerable Breezing Forms Plugin 1.2.7.42 Breezing Forms Plugin is prone to a stored cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute...

WordPress Formidable Forms plugin <=2.05.02 - Multiple vulnerabilities

Multiple vulnerabilities found by Jouko Pynnönen in WordPress Formidable Forms plugin versions =2.05.02. Unauthenticated preview function allowing shortcodes, unauthenticated form entries retrieval and Server-Side Code Execution via iThemes Sync. Solution Update the WordPress Formidable Forms...

WordPress Formidable Forms plugin <=2.05.02 - SQL Injection (SQLi) vulnerability

Blind SQL Injection SQLi vulnerability found by Jouko Pynnönen in WordPress Formidable Forms plugin versions =2.05.02. This vulnerability allows an attacker to enumerate databases and tables and retrieve their contents. Solution Update the WordPress Formidable Forms plugin to the latest available...

WordPress Formidable Forms plugin <=2.05.02 - Multiple Cross-Site Scripting (XSS) vulnerabilities

Multiple Cross-Site Scripting XSS vulnerabilities found by Jouko Pynnönen in WordPress Formidable Forms plugin versions =2.05.02. Reflected Cross-Site Scripting vulnerability in form preview and Stored Cross-Site Scripting vulnerability in form entries. Solution Update the WordPress Formidable...

Foxit Reader XFA ImageField Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...