555 matches found
CVE-2016-10705
The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module...
CVE-2016-10705
The CVE-2016-10705 entry concerns the Jetpack WordPress plugin prior to version 4.0.4, where the Likes module allows cross-site scripting (XSS). The vulnerability is documented across multiple sources (NVD, Red Hat security, CVE databases, WPVulndb) with consistent wording: XSS via the Likes modu...
CVE-2016-10706
The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link...
CVE-2016-10705
The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module...
CVE-2016-10706
The CVE-2016-10706 affects the WordPress Jetpack plugin prior to version 4.0.3. A cross-site scripting (XSS) vulnerability can be triggered by a specially crafted Vimeo link. Public sources (NVD/Red Hat/CNVD) confirm the issue as a vulnerability in Jetpack’s handling of Vimeo content; the cited r...
CVE-2016-10705: Improper Neutralization of Input During Web Page Generation
The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module...
CVE-2016-10706: Improper Neutralization of Input During Web Page Generation
The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link...
PT-2018-4878
Name of the Vulnerable Software and Affected Versions Jetpack plugin versions prior to 4.0.3 Description The issue allows for XSS attacks through a crafted Vimeo link. Recommendations For versions prior to 4.0.3, update to version 4.0.3 or later to resolve the issue...
PT-2018-4877
Name of the Vulnerable Software and Affected Versions Jetpack plugin versions prior to 4.0.4 Description The issue is related to a cross-site scripting XSS problem. It affects the Likes module of the Jetpack plugin. Recommendations For versions prior to 4.0.4, update to version 4.0.4 or later to...
Electroneum: Hackerone [Mainsite Vulnerability]
96 Hello, I was checking out the website Electroneum – Crowdfunding Token Sale – Electroneum – the mobile based cryptocurrency for any vulnerabilities through hackerone. I would like to submit a vulnerability for consideration towards a bounty. Currently you have the file...
Remote Code Execution (RCE)
Automattic/jetpack is vulnerable to remote code execution RCE attacks. The library does not properly escape csv fields, allowing a malicious user to inject a formula that will be executed by the system when the Download as a CSV feature is used...
Cross-site Scripting (XSS)
automattic/jetpack is vulnerable to cross-site scripting XSS attacks. The attacks are possible because it does not escape the URL parameter in class.jetpack-modules-list-table.php...
Cross-site Scripting (XSS)
automattic/jetpack is vulnerable to cross-site scripting XSS attacks. The library doesn't properly escape the $header parameter in the modules/shortcodes/wufoo.php file, allowing a malicious user to inject and execute arbitrary JavaScript...
Timing Attack
automattic/jetpack is vulnerable to timing attacks. This vulnerability is caused because the secrets are not compared in constant time, allowing malicious users to guess the valid secrets based on the time that a comparison takes...
Cross-site Scripting (XSS)
automattic/jetpack is vulnerable to cross-site scripting XSS attacks. The library does not parse LaTeX markup correctly, allowing a malicious user to inject and execute arbitrary webscript...
Timing Attack
jetpack is vulnerable to timing attacks. This vulnerability is caused because the HMAC hashes are not compared in constant time, allowing malicious users to guess the valid HMAC hashes based on the time that a comparison takes...
Security Bypass
jetpack is vulnerable to security bypass. The library does not properly restrict access to it's XMLRPC functions, allowing a malicious user to view confidential information or publish posts without the proper permissions...
Dolphin Jetpack - Fast & Flash - Customized SSL, Dangerous filesystem permissions, Insecure SSL socket vulnerabilities
HackApp vulnerability scanner discovered that application Dolphin Jetpack - Fast & Flash published at the 'play' market has multiple vulnerabilities...
WordPress Jetpack Plugin HTML Injection Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language.Jetpack is one of the plugin packages that includes a variety of features such as social sharing, social login and social commenting. An HTML injection vulnerability exists in WordPress...
Trello: Report bug on jetpack plugin
Hey I saw that u guys upgraded the jetpack plugin And today jetpack has relased that plugins greater 4.0.2 & 4.0.3 have multiple bugs Here is the jetpack blog https://jetpack.com/2016/06/20/jetpack-4-0-4-bug-fixes/...