Cross-site Scripting (XSS)

automattic/jetpack is vulnerable to cross-site scripting XSS attacks. The library doesn't properly escape the $header parameter in the modules/shortcodes/wufoo.php file, allowing a malicious user to inject and execute arbitrary JavaScript...

Timing Attack

automattic/jetpack is vulnerable to timing attacks. This vulnerability is caused because the secrets are not compared in constant time, allowing malicious users to guess the valid secrets based on the time that a comparison takes...

Cross-site Scripting (XSS)

automattic/jetpack is vulnerable to cross-site scripting XSS attacks. The library does not parse LaTeX markup correctly, allowing a malicious user to inject and execute arbitrary webscript...

Timing Attack

jetpack is vulnerable to timing attacks. This vulnerability is caused because the HMAC hashes are not compared in constant time, allowing malicious users to guess the valid HMAC hashes based on the time that a comparison takes...

Security Bypass

jetpack is vulnerable to security bypass. The library does not properly restrict access to it's XMLRPC functions, allowing a malicious user to view confidential information or publish posts without the proper permissions...

Dolphin Jetpack - Fast & Flash - Customized SSL, Dangerous filesystem permissions, Insecure SSL socket vulnerabilities

HackApp vulnerability scanner discovered that application Dolphin Jetpack - Fast & Flash published at the 'play' market has multiple vulnerabilities...

WordPress Jetpack Plugin HTML Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language.Jetpack is one of the plugin packages that includes a variety of features such as social sharing, social login and social commenting. An HTML injection vulnerability exists in WordPress...

Trello: Report bug on jetpack plugin

Hey I saw that u guys upgraded the jetpack plugin And today jetpack has relased that plugins greater 4.0.2 & 4.0.3 have multiple bugs Here is the jetpack blog https://jetpack.com/2016/06/20/jetpack-4-0-4-bug-fixes/...

WordPress Jetpack Plugin <= 4.0.3 - Multiple Vulnerabilities

This plugin is prone to a cross site scripting vulnerability via Likes module. Also, settings of Post By Email could be changed. Solution Upgrade this plugin...

Jetpack <= 4.0.3 - Multiple Vulnerabilities

Jetpack 4.0.4 fixes 3 security bugs: Private feedback form entries were made available publicly via the REST API Post By Email settings could be changed The Likes module was vulnerable to XSS...

Jetpack for WordPress: source code security analysis report

Several vulnerabilities were discovered in Automatic 'Jetpack for WordPress' software: Incorrect User Input Filtration when Connecting to External Files File System Path Manipulation Incorrect User Input Filtration when Using the unserialize Function Using Insufficiently Random Generators in...

Trello: XSS in Jetpack plugin

Hey, It seems like you are using an unpatched Jetpack version. Your changelog says so http://blog.trello.com/wp-content/plugins/jetpack/changelog.txt It is known to be vulnerable to XSS Check it https://jetpack.com/2016/05/27/jetpack-4-0-3-critical-security-update/ Please update your plugin. Than...

WordPress Jetpack Shortcode Embeds Module Code Injection

A cross-site scripting vulnerability exist reported in WordPress JetPack plugin Shortcode Embeds module. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

drchrono: XSS in Blog

information Discloser :- Information Discloser in your Blog www.drchrono.com/blog/readme.html. Latex HTML Element XSS :- LaTeX HTML Element XSS on Jetpack 3.9.1. your Blog is currently running an out dated version 3.9.1 of Jetpack prove...

Polldaddy Polls & Ratings <= 2.0.31 - Shortcode Stored Cross-Site Scripting (XSS)

Similar issue to the one in Jetpack's Polldaddy module...

Jetpack 2.0-4.0.2 - Shortcode Stored Cross-Site Scripting (XSS)

The Jetpack – WP Security, Backup, Speed, & Growth WordPress plugin was affected by a Shortcode Stored Cross-Site Scripting XSS security vulnerability...

WordPress Jetpack Plugin <= 4.0.2 - Stored Cross Site Scripting

This plugin is prone to a shortcode stored cross site scripting vulnerability. Solution Update the plugin...

Trello: XSS in Jetpack Plugin

The stored XSS bug puts any affected WordPress website at risk of being completely taken over. The issue was fixed earlier this week with the release of Jetpack 3.7.1 and 3.7.2, but anyone who is still running Jetpack 3.7 or lower is vulnerable. I checked and the version of jetpack plugin which y...

Firefox Add-On Flaw Leaves Apple And Windows Computers Open To Attack

Researchers warn hundreds of popular Firefox browser extensions are vulnerable to attack that could give hackers control of Mac OS X and Windows computers. Researchers from Northeastern University say the flaw is tied to Firefox’s support for an older browser extension platform and the Mozilla...

Jetpack Joyride - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Jetpack Joyride published at the 'play' market has multiple vulnerabilities...