Multiple vulnerabilities in Drupal Spider Video Player module

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. Arbitrary file deletion and cross-site request forgery vulnerabilities in the Drupal Spider Video Player module allow an attacker to exploit these vulnerabilities by...

my little forum '/index.php' cross-site scripting vulnerability

my little forum is a forum program. A cross-site scripting vulnerability exists in my little forum. The input passed to "/index.php" via the "back" GET parameter is not properly filtered before being used by the user. This allows remote attackers to trick a logged in user into opening a specially...

Microsoft Internet Explorer Remote Memory Corruption Vulnerability (CNVD-2015-01057)

Microsoft Internet Explorer is a popular WEB browser. A remote memory corruption vulnerability exists in Microsoft Internet Explorer, which could be exploited by an attacker to execute arbitrary code in the context of the currently logged in user, or to launch a denial of service attack...

Users Ultra <= 1.4.35 - SQL Injection

The AJAX action ‘editphotocate’, which is defined in the file ‘users-ultra/addons/photocategories/admin/admin.php’, allows for SQL Injection via the POST parameter ‘cateid’. This parameter is used in a call to the WordPress function ‘$wpdb-getresults’ without being sanitized. This action is...

WordPress Quasar Theme 1.9.1 Privilege Escalation

------------------------------------------------------------------------------ WordPress Quasar Theme Previlege Escalation ------------------------------------------------------------------------------ - Theme Link:...

Multiple ASUS wireless LAN routers vulnerable to cross-site request forgery

Overview Multiple wireless LAN routers provided by ASUS JAPAN Inc. contain a cross-site request forgery vulnerability. Masashi Sakai reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact If a user views a maliciou...

WordPress Plugin Pods Has Multiple Cross-Site Request Forgery Vulnerabilities

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. Multiple cross-site request forgery vulnerabilities exist in the WordPress plugin Pods, which can be exploited by an attacker...

Local file inclusion vulnerability.

PMASA-2014-14 Announcement-ID: PMASA-2014-14 Date: 2014-11-20 Summary Local file inclusion vulnerability. Description In the GIS editor feature, a parameter specifying the geometry type was not correcly validated, opening the door to a local file inclusion attack. Severity We consider this...

Food Order Portal - admin_user_delete.php Cross-Site Request Forgery

Food Order Portal - adminuserdelete.php Cross-Site Request Forgery source: https://www.securityfocus.com/bid/69787/info Food Order Portal is prone to a cross-site request-forgery vulnerability. An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the...

Food Order Portal - 'admin_user_delete.php' Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/69787/info Food Order Portal is prone to a cross-site request-forgery vulnerability. An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid ...

WordPress Plugin W3 Total Cache - admin.php Cross-Site Request Forgery

WordPress Plugin W3 Total Cache - admin.php Cross-Site Request Forgery source: https://www.securityfocus.com/bid/69745/info W3 Total Cache plugin for WordPress is prone to a cross-site request-forgery vulnerability. An attacker can exploit the cross-site request forgery issue to perform...

WordPress Plugin W3 Total Cache - 'admin.php' Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/69745/info W3 Total Cache plugin for WordPress is prone to a cross-site request-forgery vulnerability. An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected...

"Issue Does Not Exist" page leaks information to non-logged in users

Trying to open a URL for an issue that does not exist shows the "Issue Does Not Exist" error page, even if you are logged out and the project is not publicly viewable. In contrast, trying to open the URL for valid issue will prompt the user to login. In this way, an unprivileged user can learn...

Reflected Cross-Site Scripting (XSS) in BlackCat CMS

High-Tech Bridge Security Research Lab discovered vulnerability in BlackCat CMS, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Reflected Cross-Site Scripting XSS in BlackCat CMS: CVE-2014-5259 The vulnerability exists due to insufficient sanitization of the "msg" HTTP GET...

WordPress Featured Comments Plugin - Cross Site Request Forgery

Featured Comments plugin is prone to a cross-site request forgery vulnerability that allows an attacker to perform certain actions in the context of a logged-in user of the affected application. Solution Update the plugin...

WordPress Plugin Featured Comments - Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/67955/info Featured Comments plugin for WordPress is prone to a cross-site request-forgery vulnerability. An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected...

SOY CMS vulnerable to cross-site scripting

Overview SOY CMS contains a cross-site scripting vulnerability. SOY CMS provided by Nippon Institute of Agroinformatics Ltd. is an open source content management system CMS. SOY CMS contains a cross-site scripting vulnerability. Ken Asai reported this vulnerability to IPA. JPCERT/CC coordinated...

User Cake - Cross-Site Request Forgery

User Cake - Cross-Site Request Forgery source: https://www.securityfocus.com/bid/67604/info User Cake is prone to a cross-site request-forgery vulnerability because it does not properly validate HTTP requests. An attacker can exploit this issue to perform unauthorized actions in the context of a...

User Cake - Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/67604/info User Cake is prone to a cross-site request-forgery vulnerability because it does not properly validate HTTP requests. An attacker can exploit this issue to perform unauthorized actions in the context of a logged-in user of the affected...

Cybozu Garoon vulnerable to directory traversal

Overview Cybozu Garoon contains a directory traversal vulnerability. Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains a directory traversal vulnerability in the process of downloading files. Impact A user who can log in to the product may obtain files on the server...