Multiple routers contain issue in preventing clickjacking attacks

Overview Multiple router products contain an issue in the protection against clickjacking attacks. Noriaki Iwasaki of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact If a user...

Dotclear vulnerable to cross-site scripting

Overview Dotclear is a weblog software. Dotclear contains a cross-site scripting vulnerability. Yuji Tounai of NTT Com SecurityJapanKK reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact If a user views a...

(0Day) Borland AccuRev Reprise License Management Server Path Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Borland AccuRev. Authentication is not required to exploit this vulnerability. The specific flaw exists within the rlmswitchprocess functionality of the Reprise License Manager service. The issue...

WordPress Plugin BuddyPress Activity Plus 'admin-ajax' Cross-Site Request Forgery Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress plugin BuddyPress Activity Plus 'admin-ajax'. An attacker...

Cacti vulnerable to cross-site request forgery

Overview Cacti is a web application that graphs stored data collected from network devices. Cacti contains a cross-site request forgery vulnerability CWE-352. Masako Ohno reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

WordPress Plugin WPS Hide Login Cross-Site Request Forgery Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites on PHP and MySQL servers.WPS Hide Login is one of the plug-ins to change the URL of the login form. A cross-site request forgery vulnerability exis...

WordPress plugin Contact Form DB cross-site request forgery vulnerability

WordPress is the WordPress Software Foundation's suite of blogging platforms developed in the PHP language, which supports personal blog sites on PHP and MySQL servers.Contact Form DB also known as CFDB and contact-form-7-to-database-extension is one of the plugins that can submit the create and...

Multiple vulnerabilities in Drupal Spider Video Player module

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. Arbitrary file deletion and cross-site request forgery vulnerabilities in the Drupal Spider Video Player module allow an attacker to exploit these vulnerabilities by...

Microsoft Internet Explorer Remote Memory Corruption Vulnerability (CNVD-2015-01057)

Microsoft Internet Explorer is a popular WEB browser. A remote memory corruption vulnerability exists in Microsoft Internet Explorer, which could be exploited by an attacker to execute arbitrary code in the context of the currently logged in user, or to launch a denial of service attack...

my little forum '/index.php' cross-site scripting vulnerability

my little forum is a forum program. A cross-site scripting vulnerability exists in my little forum. The input passed to "/index.php" via the "back" GET parameter is not properly filtered before being used by the user. This allows remote attackers to trick a logged in user into opening a specially...

Users Ultra <= 1.4.35 - SQL Injection

The AJAX action ‘editphotocate’, which is defined in the file ‘users-ultra/addons/photocategories/admin/admin.php’, allows for SQL Injection via the POST parameter ‘cateid’. This parameter is used in a call to the WordPress function ‘$wpdb-getresults’ without being sanitized. This action is...

WordPress Quasar Theme 1.9.1 Privilege Escalation

------------------------------------------------------------------------------ WordPress Quasar Theme Previlege Escalation ------------------------------------------------------------------------------ - Theme Link:...

Multiple ASUS wireless LAN routers vulnerable to cross-site request forgery

Overview Multiple wireless LAN routers provided by ASUS JAPAN Inc. contain a cross-site request forgery vulnerability. Masashi Sakai reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact If a user views a maliciou...

WordPress Plugin Pods Has Multiple Cross-Site Request Forgery Vulnerabilities

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. Multiple cross-site request forgery vulnerabilities exist in the WordPress plugin Pods, which can be exploited by an attacker...

Local file inclusion vulnerability.

PMASA-2014-14 Announcement-ID: PMASA-2014-14 Date: 2014-11-20 Summary Local file inclusion vulnerability. Description In the GIS editor feature, a parameter specifying the geometry type was not correcly validated, opening the door to a local file inclusion attack. Severity We consider this...

Food Order Portal - admin_user_delete.php Cross-Site Request Forgery

Food Order Portal - adminuserdelete.php Cross-Site Request Forgery source: https://www.securityfocus.com/bid/69787/info Food Order Portal is prone to a cross-site request-forgery vulnerability. An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the...

Food Order Portal - 'admin_user_delete.php' Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/69787/info Food Order Portal is prone to a cross-site request-forgery vulnerability. An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid ...

WordPress Plugin W3 Total Cache - admin.php Cross-Site Request Forgery

WordPress Plugin W3 Total Cache - admin.php Cross-Site Request Forgery source: https://www.securityfocus.com/bid/69745/info W3 Total Cache plugin for WordPress is prone to a cross-site request-forgery vulnerability. An attacker can exploit the cross-site request forgery issue to perform...

WordPress Plugin W3 Total Cache - 'admin.php' Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/69745/info W3 Total Cache plugin for WordPress is prone to a cross-site request-forgery vulnerability. An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected...

"Issue Does Not Exist" page leaks information to non-logged in users

Trying to open a URL for an issue that does not exist shows the "Issue Does Not Exist" error page, even if you are logged out and the project is not publicly viewable. In contrast, trying to open the URL for valid issue will prompt the user to login. In this way, an unprivileged user can learn...