8273 matches found
WordPress GoCodes Plugin <= 1.3.5 - Multiple Vulnerabilities
This plugin is prone to cross site scripting vulnerability, that allows authenticated users to inject HTML and JS code. And also there is an SQL injection vulnerability, that allows authenticated users execute arbitrary SQL commands. Solution Update the plugin...
WordPress Social Share Button Plugin <= 2.1 - Stored Cross Site Scripting (XSS)
Because of this vulnerability, authenticated administrators can store HTML or JS code. Solution Update the plugin...
WordPress Websimon Tables Plugin <= 1.3.4 - Reflected Cross Site Scripting
Because of this vulnerability, authenticated administrators can inject HTML or JS code. Solution Update the plugin...
WordPress My Link Order Plugin <= 4.3 - Cross Site Scripting (XSS)
Because of this XSS vulnerability, authenticated users can inject HTML or JS code. Vulnerable parameters are "cats" and "hdnCatID". Solution Update the plugin...
WordPress My Link Order Plugin <= 4.3 - Cross Site Scripting (XSS)
Because of this XSS vulnerability, authenticated users can inject HTML or JS code. Vulnerable parameters are "cats" and "hdnCatID". Solution Update the plugin...
Updated uglify-js packages fix security vulnerability
The UglifyJS node module has a problem where the combination of De Morgan's Law and non-boolean values can lead to a case where code is incorrectly minified, which can lead to possibly malicious minified JS code...
CVE-2015-8105
Cross-site scripting XSS vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload...
PT-2015-2647
Name of the Vulnerable Software and Affected Versions RoundCube Webmail versions prior to 1.0.7 RoundCube Webmail versions 1.1.x prior to 1.1.3 Description The issue exists due to a lack of protection for the web page structure in the RoundCube Webmail component program/js/app.js. This allows a...
CVE-2015-8105: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload...
CVE-2015-5733: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via an accessibility-helper title...
Regular Expression Denial of Service
Overview Versions of uglify-js prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the parse method. Proof of Concept var u = require'uglify-js'; var genstr = function len, chr var result = ""; for i=0; i=len; i++ result = resu...
MDM the mobile terminal management system of the SAP Afaria stored XSS vulnerability using process-vulnerability warning-the black bar safety net
Here, will demo on SAP Afaria, a world-renowned MDM mobile terminal management software for the vulnerability analysis,while the analysis of the network how could an attacker exploit the vulnerability to attack. The black bar safety net Wikipedia: what is MDM? In short, MDM is to help...
Deserialization Code Execution
Overview Versions 2.0.4 and earlier of js-yaml are affected by a code execution vulnerability in the YAML deserializer. Proof of Concept const yaml = require'js-yaml'; const x = test: !!js/function function f console.log1; ; yaml.loadx; Recommendation Update js-yaml to version 2.0.5 or later, and...
Reflected Cross-Site Scripting (XSS) in SourceBans
High-Tech Bridge Security Research Lab discovered vulnerability in SourceBans, which can be exploited to perform Cross-Site Scripting XSS attacks against web application users. The vulnerability exists due to insufficient filtration of input-data passed via the "advSearch" HTTP GET parameter to...
PT-2015-7345
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 47.0.2526.73 Opera affected versions not specified Description The issue is related to the improper implementation of certain map and filter operations for arrays in the js/array.js file of Google V8. This allow...
PT-2015-2164
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 41.0 Description The issue is related to the mishandling of certain receiver arguments in the js/src/proxy/Proxy.cpp component, which can be exploited by remote attackers to bypass intended window access...
CVE-2015-6969
Cross-site scripting XSS vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link...
CVE-2015-6969: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link...
PT-2015-7429
Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.0.2 Description A cross-site scripting XSS issue exists due to improper handling of user input in the 2k11 theme, specifically in the js/2k11.min.js file. This allows remote attackers to inject arbitrary web...