WPtouch / WPtouch Pro XSS / Path Disclosure

Hello list! I want to inform you about vulnerabilities in WPtouch and WPtouch Pro plugins for WordPress. These are Cross-Site Scripting and Full path disclosure vulnerabilities. These XSS holes are in ZeroClipboard.swf, which is used in the plugin. In February I wrote about Cross-Site Scripting...

phpMyAdmin -- multiple vulnerabilities

The phpMyAdmin development team reports: XSS due to unescaped HTML Output when executing a SQL query. 5 XSS vulnerabilities in setup, chart display, process list, and logo link. If a crafted version.json would be presented, an XSS could be introduced. Full path disclosure vulnerabilities. XSS...

Multiple vulnerabilities in Googlemaps plugin for Joomla

Hello 3APA3A! These are Denial of Service, XML Injection, Cross-Site Scripting and Full path disclosure vulnerabilities in Googlemaps plugin for Joomla. ------------------------- Affected products: ------------------------- Vulnerable are Googlemaps plugin for Joomla versions 2.x and 3.x and...

CS, XSS and FPD vulnerabilities in WordPress

Hello 3APA3A! These are Content Spoofing, Cross-Site Scripting and Full path disclosure vulnerabilities in WordPress. At WordPress 3.5.2 release the same at 3.5.1 release, WP developers mentioned about multiple fixed holes, but not about all - to make it looks like there were less fixed holes. So...

XSS, CS and FPD vulnerabilities in I Love It theme for WordPress

Hello 3APA3A! These are Cross-Site Scripting, Content Spoofing and Full path disclosure vulnerabilities in I Love It theme for WordPress. This is commercial premium theme. ------------------------- Affected products: ------------------------- All versions of I Love It theme for WordPress. The the...

[ISecAuditors Security Advisories] Multiple Vulnerabilities in Telaen <= 1.3.0

============================================= INTERNET SECURITY AUDITORS ALERT 2013-009 - Original release date: March 15th, 2013 - Last revised: June 4th, 2013 - Discovered by: Manuel Garcia Cardenas - Severity: 4,8/10 CVSS Base Score - CVE-ID: CVE-2013-2621, CVE-2013-2623, CVE-2013-2624...

WordPress I Love It XSS / Content Spoofing / Path Disclosure

Hello list! These are Cross-Site Scripting, Content Spoofing and Full path disclosure vulnerabilities in I Love It theme for WordPress. This is commercial premium theme. ------------------------- Affected products: ------------------------- All versions of I Love It theme for WordPress. The theme...

Corda Highwire - 'Highwire.ashx' Full Path Disclosure

source: https://www.securityfocus.com/bid/61152/info Corda Highwire is prone to a path disclosure vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to obtain sensitive information that may lead to further attacks...

FPD, XSS and CS vulnerabilities in Slash WP theme for WordPress

Hello 3APA3A! I want to warn you about multiple vulnerabilities in Slash WP theme for WordPress. This is commercial theme for WP. These are Full path disclosure, Cross-Site Scripting and Content Spoofing vulnerabilities. ------------------------- Affected products: -------------------------...

XSS and FPD vulnerabilities in Search 'N Save for WordPress

Hello 3APA3A! I want to inform you about vulnerabilities in Search 'N Save plugin for WordPress. These are Cross-Site Scripting and Full path disclosure vulnerabilities. These XSS holes are in ZeroClipboard.swf, which is used in the plugin. In February I wrote about Cross-Site Scripting...

XSS and FPD vulnerabilities in I Love It New theme for WordPress

Hello 3APA3A! These are Cross-Site Scripting and Full path disclosure vulnerabilities in I Love It New theme for WordPress. This is commercial premium theme. Earlier I've wrote about vulnerabilities in VideoJS http://seclists.org/fulldisclosure/2013/May/21 and in multiple web applications...

XSS and FPD vulnerabilities in Search and Share for WordPress

Hello 3APA3A! I want to inform you about vulnerabilities in Search and Share plugin for WordPress. These are Cross-Site Scripting and Full path disclosure vulnerabilities. These XSS holes are in ZeroClipboard.swf, which is used in the plugin. In February I've wrote about Cross-Site Scripting...

FPD and Security bypass vulnerabilities in AntiVirus for WordPress

Hello 3APA3A! These are Full path disclosure and Security bypass vulnerabilities in AntiVirus for WordPress. This is security plugin for detecting exploits and backdoors in WordPress. Which failed to identify my Backdoored Web Application BWA - a reference test of backdoor scanners released in...

WordPress Search N Save XSS / Path Disclosure

Hello list! I want to inform you about vulnerabilities in Search 'N Save plugin for WordPress. These are Cross-Site Scripting and Full path disclosure vulnerabilities. These XSS holes are in ZeroClipboard.swf, which is used in the plugin. In February I wrote about Cross-Site Scripting...

WordPress Update 3.5.2 Patches Seven Vulnerabilities

WordPress, which has been a jumping off point for a number of targeted attacks and other high-profile hacks, has been updated and the latest version includes a number of security patches. Version 3.5.2, released late last week, includes seven security fixes and some additional hardening, accordin...

WordPress Slash Theme XSS / Spoofing / Disclosure Vulnerabilities

The Slash theme for WordPress suffers from cross site scripting, content spoofing, and path disclosure vulnerabilities. Hello list! I want to warn you about multiple vulnerabilities in Slash WP theme for WordPress. This is commercial theme for WP. These are Full path disclosure, Cross-Site...

WordPress Slash Theme XSS / Spoofing / Disclosure

Hello list! I want to warn you about multiple vulnerabilities in Slash WP theme for WordPress. This is commercial theme for WP. These are Full path disclosure, Cross-Site Scripting and Content Spoofing vulnerabilities. ------------------------- Affected products: -------------------------...

WordPress Spider Catalog Plugin 1.4.6 - Multiple Vulnerabilities

Spider Catalog plugin is prone to multiple vulnerabilities. These vulnerabilities are: 1. SQL Injection in Spider Catalog Shortcodes; 2. SQL Injection in "catalog.php" function "catalogaftersearchresults"; 3. SQL Injection in "Categories.php" function "changecat"; 4. SQL Injection in...

Ajax Availability Calendar 3.x - Multiple Vulnerabilities

Ajax Availability Calendar 3.x - Multiple Vulnerabilities Ajax Availability Calendar 3.X.X Multiple Vulnerabilties ============================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://www.ajaxavailabilitycalendar.com/ .:. Dork : intitle:"Aja...

Ajax Availability Calendar 3.x - Multiple Vulnerabilities

Ajax Availability Calendar 3.X.X Multiple Vulnerabilties ============================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://www.ajaxavailabilitycalendar.com/ .:. Dork : intitle:"Ajax Availability Calendar" , inurl:"/ac-admin/index.php" ===...