1216 matches found
WordPress SE HTML5 Album Audio Player 1.1.0 Directory Traversal Vulnerability
WordPress SE HTML5 Album Audio Player plugin version 1.1.0 suffers from a traversal vulnerability. Title: Path Traversal vulnerability in Wordpress plugin se-html5-album-audio-player v1.1.0 Author: Larry W. Cashdollar, @larry0 Date: 2015-06-06 Advisory: http://www.vapid.dhs.org/advisory.php?v=124...
WordPress SE HTML5 Album Audio Player 1.1.0 Directory Traversal
Title: Path Traversal vulnerability in Wordpress plugin se-html5-album-audio-player v1.1.0 Author: Larry W. Cashdollar, @larry0 Date: 2015-06-06 Advisory: http://www.vapid.dhs.org/advisory.php?v=124 Download Site: https://wordpress.org/plugins/se-html5-album-audio-player/ Vendor:...
SE HTML5 Album Audio Player <= 1.1.0 - Local File Include
The se-html5-album-audio-player v1.1.0 plugin for wordpress has a local file include vulnerability. The downloadaudio.php file does not check to see if the user is authenticated, it only attempts to check if the path is in /wp-content/uploads which is easily defeated with ../...
openSUSE Security Update : LibVNCServer (openSUSE-2015-377)
LibVNCServer was updated to version 0.9.10 to fix several security and non-security issues. The following issues were fixed : - Remove xorg-x11-devel from buildRequires, X libraries are not directly used/linked - libvncserver-0.9.10-ossl.patch: Update, do not RANDloadfile'/dev/urandom', 1024 if t...
Web India Solutions CMS 2015 SQL Injection
Document Title: =============== Web India Solutions CMS 2015 - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1495 Release Date: ============= 2015-05-13 Vulnerability Laboratory ID VL-ID: ====================================...
Web India Solutions CMS 2015 - SQL Injection Vulnerability
Document Title: =============== Web India Solutions CMS 2015 - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1495 Release Date: ============= 2015-05-12 Vulnerability Laboratory ID VL-ID: ====================================...
novnc session hijacking vulnerability-vulnerability warning-the black bar safety net
Affected system: github noVNC 0.5 Description: -------------------------------------------------------------------------------- CVECAN ID: CVE-2 0 1 3-7 4 3 6 noVNC is a HTML5 Canvas and WebSockets implemented a browser-based VNC client. noVNC 0.5 before the version without the https session...
Moderate: Red Hat Security Advisory: novnc security update
An updated novnc package that fixes one security issue is now available for Red Hat Enterprise Linux OpenStack Platform 4.0. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
Moderate: Red Hat Security Advisory: novnc security update
An updated novnc package that fixes one security issue is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, whi...
Moderate: Red Hat Security Advisory: novnc security update
An updated novnc package that fixes one security issue is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, whi...
WordPress Work The Flow File Upload 2.5.2 - Arbitrary File Upload Vulnerability
Exploit for php platform in category web applications Exploit Title : Wordpress Work the flow file upload 2.5.2 Shell Upload Vulnerability Exploit Author : Claudio Viviani Software Link : https://downloads.wordpress.org/plugin/work-the-flow-file-upload.2.5.2.zip Date : 2015-03-14 Tested on : Linu...
Moderate: Red Hat Security Advisory: novnc security update
An updated novnc package that fixes one security issue is now available for Red Hat Enterprise Linux OpenStack Platform 6.0. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
Coinbase: Sandboxed iframes don't show confirmation screen
Just like I anticipated in 2013 http://homakov.blogspot.com/2013/04/html5-sandbox-bad-idea.html sandbox was a bad idea. As a payment gateway you do your best to seamlessly integrate with your customers and allow showing checkout in iframes. To prevent basic clickjacking you have data-confirm...
HackerOne: Reflected Filename Download
First of all congratulations on awesome bounty system. Big fan here! I found out that it's possible run a RFD attack on Hackerone. If we visit: https://hackerone.com/dsopas We see the normal HTML webpage. Nothing new here. But if we add ?format=json to the URL we can see the JSON file generated b...
XSSYA v2.0 - Cross Site Scripting Scanner & Vulnerability Confirmation
XSSYA Cross Site Scripting Scanner & Vulnerability Confirmation written in python scripting language confirm the XSS Vulnerability in two method first work by execute the payload encoded to bypass Web Application Firewall which is the first method request and responseif it respond 200 it turn...
SA-CONTRIB-2015-059 - Spider Video Player - Multiple vulnerabilities - Unsupported
Spider Video Player module enables you to add HTML5 and Flash videos to your site. The module doesn't sufficiently check user input when deleting files. A malicious user could delete arbitrary files by making a request to a specially-crafted URL. This vulnerability is mitigated by the fact that t...
Google releases Cloud-based Web App Vulnerability Scanner and Assessment Tool
Google on Thursday unleashed its own free web application vulnerability scanner tool, which the search engine giant calls Google Cloud Security Scanner, that will potentially scan developers' applications for common security vulnerabilities on its cloud platform more effectively. SCANNER ADDRESSE...
eYou mail system The message body stored XSS（HTML5 features and need to click on the-vulnerability warning-the black bar safety net
Since eyou version number is different, the following test code The effect is a subtle distinction, but the presence of the vulnerability causes of the same. Test code: !-- if trueimg onerror=alert1 src=--form action=javascript:alert2input type=submitinput autofocus onfocus=alert3select autofocus...
WebRTC Found Leaking Local IP Addresses
A recently publicized hole in WebRTC, a protocol for web communication, is revealing the local IP addresses of users, even those who go to extra lengths to hide theirs by using a virtual private network. Daniel Roesler, a San Francisco-based researcher who’s dabbled in encryption, posted a...
