CVE-2014-9392: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the PictoBrowser pictobrowser-gallery plugin 0.3.1 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the pictoBrowserFlickrUser parameter ...

CVE-2014-9397: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the twimp-wp plugin for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the messageformat parameter in the twimp-wp.php page to...

CVE-2014-9401: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the WP Limit Posts Automatically plugin 0.7 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the lpapostletters parameter in the...

PT-2014-8989

Name of the Vulnerable Software and Affected Versions Twitter LiveBlog plugin versions 1.1.2 and earlier for WordPress Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS...

PT-2014-8985

Name of the Vulnerable Software and Affected Versions WordPress PWGRandom plugin version 1.11 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the pwgrandom tit...

CVE-2014-9393: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Post to Twitter plugin 0.7 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 idptttwitterusername or 2 idptttweetprefi...

CVE-2014-9391: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the gSlideShow plugin 0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 rss, 2 displaytime or 3 transistiontime...

WSS is the latest version of any user of the password reset（official demo demo-the vulnerability warning-the black bar safety net

WSS latest version of the design flaws lead to arbitrary user password reset, including the administrator 文件 usereditpassword.php code area ? php $editFormAction = $SERVER'PHPSELF'; if isset$SERVER'QUERYSTRING' $editFormAction .= "?" . htmlentities$SERVER'QUERYSTRING'; $password = "-1"; if...

PT-2014-8991

Name of the Vulnerable Software and Affected Versions Wp Unique Article Header Image plugin version 1.0 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the gt...

CVE-2014-9334: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Bird Feeder plugin 1.2.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 user or 2 password parameter in the bird-feeder page to...

PT-2014-8937

Name of the Vulnerable Software and Affected Versions Bird Feeder plugin version 1.2.3 Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the user or password parameter in th...

Design/Logic Flaw

The parserequest function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service crash via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method...

CVE-2013-7401

The parserequest function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service crash via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method...

CVE-2013-7401

The parserequest function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service crash via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method...

CVE-2014-9335

Multiple cross-site request forgery CSRF vulnerabilities in the DandyID Services plugin 1.5.9 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 emailaddress or 2 sidebarTitle paramet...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the yURL ReTwitt plugin 1.4 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 yurllogin or 2 yurlanchor parameter in the...

CVE-2014-9335

Multiple cross-site request forgery CSRF vulnerabilities in the DandyID Services plugin 1.5.9 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 emailaddress or 2 sidebarTitle paramet...

CVE-2014-9338

CVE-2014-9338 concerns the WordPress plugin O2Tweet (versions 0.0.4 and earlier). The connected documents describe multiple CSRF vulnerabilities that allow remote attackers to hijack an administrator’s authentication for requests that trigger cross-site scripting (XSS) via the parameters o2t_user...

PT-2014-8941

Name of the Vulnerable Software and Affected Versions O2Tweet plugin versions 0.0.4 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the o2t username or o2t tag...

CVE-2014-9337: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Mikiurl Wordpress Eklentisi plugin 2.0 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 twitterkullanici or 2...