OkCupid: Reflected XSS on www.okcupid.com/signup

Reflected XSS on www.okcupid.com/signup Im using Live HTTP Header for this bug. 1 Go to https://www.okcupid.com/signup 2 Click on continue 3 Enter details 4 Live HTTP Headers or any HTTP Editor should be running before clicking "Next" button. 5 Edit the following POST Headers : Host:...

Localize: A Serious Bug on SIGNUP Process!

Hello, I found a bug on your registration/Sign UP process.. You should fix this one soon as Possible! With This bug, Attacker will able to create thousands of ID's on you application.. POC ------ it can be done in three 3 ways.. 1 By CSRF .. Copy You Registration FORM source only form code is...

5-year-old Boy discovers Microsoft Xbox Password Bypass vulnerability

A 5-year-old San Diego boy managed to hack one of the most popular gaming systems in the world, Xbox and has now been acknowledged as a security researcher by Microsoft. Kristoffer Von Hassel uncovered a vulnerability in Xbox Live's password system, that would allow someone to log into a Xbox...

openstack-nova: XenAPI security groups not kept through migrate or resize

The XenAPI backend in OpenStack Compute Nova Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups 1 when resizing an image or 2 during live migration, which allows remote attackers to bypass intended restrictions...

Nova: insecure directory permissions in snapshots

OpenStack Compute Nova Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporary directory used to store live snapshots, which allows local users to read and modify live snapshots...

nova: Live migration can leak root disk into ephemeral storage

The icreateimagesandbacking aka createimagesandbacking method in libvirt driver in OpenStack Compute Nova Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users vi...

WordPress VideoWhisper Live Streaming Integration Multiple Vulnerabilities

WordPress VideoWhisper Live Streaming Integration Plugin is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2014-1906

Multiple cross-site scripting XSS vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 m parameter to lbstatus.php; 2 msg parameter to vcchatlog.php; n parameter to 3 channel.php, ...

CVE-2014-1907

Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to 1 read arbitrary files via a .. dot dot in the s parameter to ls/rtmplogin.php or 2 delete arbitrary files via a .. dot dot in the s parameter t...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 m parameter to lbstatus.php; 2 msg parameter to vcchatlog.php; n parameter to 3 channel.php, ...

CVE-2014-1906

Multiple cross-site scripting XSS vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 m parameter to lbstatus.php; 2 msg parameter to vcchatlog.php; n parameter to 3 channel.php, ...

CVE-2014-1907

Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to 1 read arbitrary files via a .. dot dot in the s parameter to ls/rtmplogin.php or 2 delete arbitrary files via a .. dot dot in the s parameter t...

CVE-2014-1907

VideoWhisper Live Streaming Integration plugin for WordPress (v4.x prior to 4.29.5) contains directory traversal vulnerabilities (CVE-2014-1907) that allow remote attackers to read arbitrary files via a .. in the s parameter to ls/rtmp_login.php and to delete arbitrary files via a .. in the s par...

CVE-2014-1906

CVE-2014-1906 concerns the VideoWhisper Live Streaming Integration plugin for WordPress. The vulnerability involves multiple cross-site scripting (XSS) flaws in the plugin prior to version 4.29.5, allowing remote attackers to inject arbitrary script or HTML through various parameters (lb_status.p...

WordPress VideoWhisper Live Streaming Integration多个信息泄漏漏洞

Bugtraq ID:65880 CVE ID:CVE-2014-1908 WordPress是一种使用PHP语言开发的博客平台，用户可以在支持PHP和MySQL数据库的服务器上架设自己的网志。 WordPress VideoWhisper Live Streaming Integration多个脚本不正确实现错误处理机制，允许远程攻击者利用漏洞提交特制的HTTP GET请求，获取敏感应用信息。 0 WordPress VideoWhisper Live Streaming Integration 4.27.3 厂商补丁： WordPress ----- WordPress...

WordPress VideoWhisper Live Streaming Integration多个跨站脚本漏洞

Bugtraq ID:65876 CVE ID:CVE-2014-1906 WordPress是一种使用PHP语言开发的博客平台，用户可以在支持PHP和MySQL数据库的服务器上架设自己的网志。 WordPress VideoWhisper Live Streaming Integration存在多个跨站脚本漏洞，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 WordPress VideoWhisper Live Streaming Integration 4.27.3 厂商补丁： WordPress ----- WordPre...

WordPress VideoWhisper Live Streaming Integration任意文件上传漏洞

Bugtraq ID:65866 CVE ID:CVE-2014-1905 WordPress是一种使用PHP语言开发的博客平台，用户可以在支持PHP和MySQL数据库的服务器上架设自己的网志。 WordPress VideoWhisper Live Streaming Integration所包含的"/wp-content/plugins/videowhisper-live-streaming-integration/ls/vwsnaps hots.php"在上传文件到服务器时没有正确校验恶意文件扩展，可导致远程攻击者上传和执行任意PHP文件。 0 WordPress...

PT-2014-4356 · Videowhisper · Videowhisper Live Streaming Integration

Name of the Vulnerable Software and Affected Versions: VideoWhisper Live Streaming Integration plugin versions prior to 4.29.5 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via...

nova: Live migration can leak root disk into ephemeral storage

The icreateimagesandbacking aka createimagesandbacking method in libvirt driver in OpenStack Compute Nova Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users vi...

Nova: insecure directory permissions in snapshots

OpenStack Compute Nova Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporary directory used to store live snapshots, which allows local users to read and modify live snapshots...