Dolphin Jetpack - Fast & Flash - Customized SSL, Dangerous filesystem permissions, Insecure SSL socket vulnerabilities

HackApp vulnerability scanner discovered that application Dolphin Jetpack - Fast & Flash published at the 'play' market has multiple vulnerabilities...

WordPress Jetpack Plugin HTML Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language.Jetpack is one of the plugin packages that includes a variety of features such as social sharing, social login and social commenting. An HTML injection vulnerability exists in WordPress...

Trello: Report bug on jetpack plugin

Hey I saw that u guys upgraded the jetpack plugin And today jetpack has relased that plugins greater 4.0.2 & 4.0.3 have multiple bugs Here is the jetpack blog https://jetpack.com/2016/06/20/jetpack-4-0-4-bug-fixes/...

WordPress Jetpack Plugin <= 4.0.3 - Multiple Vulnerabilities

This plugin is prone to a cross site scripting vulnerability via Likes module. Also, settings of Post By Email could be changed. Solution Upgrade this plugin...

Jetpack <= 4.0.3 - Multiple Vulnerabilities

Jetpack 4.0.4 fixes 3 security bugs: Private feedback form entries were made available publicly via the REST API Post By Email settings could be changed The Likes module was vulnerable to XSS...

Jetpack for WordPress: source code security analysis report

Several vulnerabilities were discovered in Automatic 'Jetpack for WordPress' software: Incorrect User Input Filtration when Connecting to External Files File System Path Manipulation Incorrect User Input Filtration when Using the unserialize Function Using Insufficiently Random Generators in...

Trello: XSS in Jetpack plugin

Hey, It seems like you are using an unpatched Jetpack version. Your changelog says so http://blog.trello.com/wp-content/plugins/jetpack/changelog.txt It is known to be vulnerable to XSS Check it https://jetpack.com/2016/05/27/jetpack-4-0-3-critical-security-update/ Please update your plugin. Than...

WordPress Jetpack Shortcode Embeds Module Code Injection

A cross-site scripting vulnerability exist reported in WordPress JetPack plugin Shortcode Embeds module. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

drchrono: XSS in Blog

information Discloser :- Information Discloser in your Blog www.drchrono.com/blog/readme.html. Latex HTML Element XSS :- LaTeX HTML Element XSS on Jetpack 3.9.1. your Blog is currently running an out dated version 3.9.1 of Jetpack prove...

Polldaddy Polls & Ratings <= 2.0.31 - Shortcode Stored Cross-Site Scripting (XSS)

Similar issue to the one in Jetpack's Polldaddy module...

WordPress Jetpack Plugin <= 4.0.2 - Stored Cross Site Scripting

This plugin is prone to a shortcode stored cross site scripting vulnerability. Solution Update the plugin...

Jetpack 2.0-4.0.2 - Shortcode Stored Cross-Site Scripting (XSS)

The Jetpack – WP Security, Backup, Speed, & Growth WordPress plugin was affected by a Shortcode Stored Cross-Site Scripting XSS security vulnerability...

Trello: XSS in Jetpack Plugin

The stored XSS bug puts any affected WordPress website at risk of being completely taken over. The issue was fixed earlier this week with the release of Jetpack 3.7.1 and 3.7.2, but anyone who is still running Jetpack 3.7 or lower is vulnerable. I checked and the version of jetpack plugin which y...

Firefox Add-On Flaw Leaves Apple And Windows Computers Open To Attack

Researchers warn hundreds of popular Firefox browser extensions are vulnerable to attack that could give hackers control of Mac OS X and Windows computers. Researchers from Northeastern University say the flaw is tied to Firefox’s support for an older browser extension platform and the Mozilla...

Jetpack Joyride - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Jetpack Joyride published at the 'play' market has multiple vulnerabilities...

WordPress Jetpack Plugin <= 3.9.1 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

Jetpack <= 3.9.1 - LaTeX HTML Element XSS

The Jetpack – WP Security, Backup, Speed, & Growth WordPress plugin was affected by a LaTeX HTML Element XSS security vulnerability...

Magento the presence of XSS vulnerability, the online Mall may be the attacker's control-the vulnerability warning-the black bar safety net

Magento is an open source e-Commerce system, is a major business-oriented application, The processing of e-Commerce needs, including shopping, shipping, product reviews, etc., and ultimately for the construction of a multipurpose and wide application of e-Commerce websites to provide help. Magent...

Automattic: Possible Timing Side-Channel in XMLRPC Verification

https://github.com/Automattic/jetpack/blob/bc7a4541ef6f0e9f583376d801ab0c40cfb976c3/class.jetpack-xmlrpc-server.phpL115 I mentioned this to @daljo628 and he suggested submitting it here instead. This looks very much like a classic timing attack vulnerability. The fix would be to use hashequals...

WordPress Jetpack Plugin Security Patch

After a few critical bugs were recently discovered and patched in the core WordPress engine—a rarity with WordPress-related security issues—order has apparently been restored with the discovery of a critical vulnerability in a popular plugin. Insecure plugins have been at the heart of numerous...