CVE-2017-18088: Improper Input Validation

Various plugin servlet resources in Atlassian Bitbucket Server before version 5.3.7 the fixed version for 5.3.x, from version 5.4.0 before 5.4.6 the fixed version for 5.4.x, from version 5.5.0 before 5.5.6 the fixed version for 5.5.x, from version 5.6.0 before 5.6.3 the fixed version for 5.6.x,...

correctionenterprises.com XSS vulnerability

Open Bug Bounty ID: OBB-549403 Description| Value ---|--- Affected Website:| correctionenterprises.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Legal Robot: Clickjacking in Legalrobot app

Dear Team, POC Please find attached screenshots Steps to reproduce: create index.html file with following content: Open index.html in browser Actual result: Legalrobot email verification page is viewed in iframe. Remediation: Frame busting technique is the better framing protection technique...

CVE-2017-7667

CVE-2017-7667 affects Apache NiFi versions prior to 0.7.4 and 1.x prior to 1.3.0. The issue is an Origin Validation/Framing problem where NiFi did not set a suitable X-Frame-Options header, leaving the application vulnerable to cross-frame framing attacks. Connected advisories (GHSA/JQ99, CNVD/CN...

CVE-2017-7667

Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin...

PT-2017-17873

Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 0.7.4 Apache NiFi 1.x versions prior to 1.3.0 Description The issue arises from Apache NiFi's failure to establish a response header that instructs browsers to only allow framing from the same origin. This could...

openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2017-629)

This update for java-170-openjdk fixes the following issues : - Update to 2.6.10 - OpenJDK 7u141 bsc1034849 - Security fixes - S8163520, CVE-2017-3509: Reuse cache entries - S8163528, CVE-2017-3511: Better library loading - S8165626, CVE-2017-3512: Improved window framing - S8167110, CVE-2017-351...

WordPress Magic Fields 1 plugin cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Wordpress Magic Fields 1 plugin, which allows an attacker to frame malicio...

WordPress Corner Ad Plugin Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the wordpress Corner Ad plugin, which allows attackers to frame malicious web...

wordpress plugin event-notifier cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the wordpress plugin event-notifier, which allows attackers to frame malicious...

wordpress plugin front-end-post-edit cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the wordpress plugin front-end-post-edit, which allows an attacker to frame...

wordpress plugin keywords-to-amazon-links cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the wordpress plugin keywords-to-amazon-links, which allows an attacker to fra...

Cross-site scripting vulnerability in wordpress plugin tagmaker

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. The wordpress plugin tagmaker suffers from a cross-site scripting vulnerability due to improper filtering of user input, whic...

Cross-site scripting vulnerability in wordpress plugin tinyfier-wp

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. The wordpress plugin tinyfier-wp suffers from a cross-site scripting vulnerability due to improper filtering of user input,...

wordpress plugin Germany-likes-opt-in-facebook cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. The wordpress plugin Germany-likes-opt-in-facebook suffers from an xss vulnerability due to improper filtering of user input,...

wordpress plugin editionguard-for-wp-e-commerce-ebook-sales-with-drm cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the wordpress plugin editionguard-for-wp-e-commerce-ebook-sales-with-drm, whic...

Cross-site scripting vulnerability in wordpress plugin prettypre

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. The wordpress plugin prettypre suffers from a cross-site scripting vulnerability due to improper filtering of user input, whi...

wordpress plugin funny-branding cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the wordpress plugin funny-branding, which allows an attacker to frame malicio...

Wordpress plugin sagepay-server-gateway-for-jigoshop has cross-site scripting hole

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. The Wordpress plugin sagepay-server-gateway-for-jigoshop has a cross-site scripting hole. The program fails to filter user-supplied input, allowing attackers to fra...

Wordpress plugin trail-passion has xss vulnerability

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. Wordpress plugin trail-passion suffers from an xss vulnerability due to improper filtering of user input, which allows attackers to frame malicious web pages, trick...