rt -- XSS via jQuery

BestPractical reports: The version of jQuery used in RT 4.2 and 4.4 has a Cross-site Scripting XSS vulnerability when using cross-domain Ajax requests. This vulnerability is assigned CVE-2015-9251. RT does not use this jQuery feature so it is not directly vulnerable. jQuery version 1.12 no longer...

Severe Flaws in SHAREit Android App Let Hackers Steal Your Files

Security researchers have discovered two high-severity vulnerabilities in the SHAREit Android app that could allow attackers to bypass device authentication mechanism and steal files containing sensitive from a victim's device. With over 1.5 billion users worldwide, SHAREit is a popular file...

WordPress Social Networks Auto-Poster 4.2.7 Cross Site Scripting

Vulnerability: XSS Affected Software: NextScripts: Social Networks Auto-Poster Affected Version: 4.2.7 Patched Version: 4.2.8 CVE: not requested Risk: Medium Vendor Contacted: 10/25/2018 Vendor Fix: 11/02/2018 Public Disclosure: 02/05/2019 Credit: Tim Coen CVSS 6.1 Medium...

WordPress WP Live Chat 8.0.18 Cross Site Scripting

Vulnerability: XSS Affected Software: WP Live Chat Support Affected Version: 8.0.18 Patched Version: CVE: not requested Risk: Medium Vendor Contacted: 10/31/2018 Vendor Fix: 11/01/2018 Public Disclosure: 02/05/2019 Credit: Tim Coen CVSS 6.1 Medium CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...

WordPress Contact Form Email 1.2.65 CSRF / Cross Site Scripting

Vulnerability: XSS & CSRF Affected Software: Contact Form Email Affected Version: 1.2.65 Patched Version: 1.2.66 CVE: not requested Risk: Medium Vendor Contacted: 10/31/2018 Vendor Fix: 10/31/2018 Public Disclosure: 02/05/2019 Credit: Tim Coen Reflected XSS CVSS 6.1 Medium...

WordPress Give 2.3.0 Cross Site Scripting

Vulnerability: XSS Affected Software: Give Affected Version: 2.3.0 Patched Version: 2.3.1 CVE: not requested Risk: Medium Vendor Contacted: 11/24/2018 Vendor Fix: 12/13/2018 Public Disclosure: 02/05/2019 Credit: Tim Coen CVSS 6.1 Medium CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Overview The Gi...

WordPress Forminator 1.5.4 Cross Site Scripting / SQL Injection

Vulnerability: Unauthenticated Persistent XSS, Blind SQL Injection Affected Software: Forminator Affected Version: 1.5.4 Patched Version: 1.6 CVE: not requested Risk: High Vendor Contacted: 11/25/2018 Vendor Fix: 12/10/2018 Public Disclosure: 02/05/2019 Credit: Tim Coen Unauthenticated Persistent...

PT-2018-15321 · Igraph +1 · Igraph +1

Name of the Vulnerable Software and Affected Versions: igraph versions through 0.7.1 Description: The issue is related to a NULL pointer dereference in the igraph i strdiff function within igraph trie.c, which can be exploited by attackers to cause a denial of service, resulting in an application...

Integria IMS 5.0.83 - search_string Cross-Site Scripting

Integria IMS 5.0.83 - searchstring Cross-Site Scripting Exploit Title: Integria IMS 5.0.83 - Cross-Site Scripting Exploit Author: Javier Olmedo Website: https://hackpuntes.com Date: 2018-12-18 Google Dork: N/A Vendor: Artica ST Software Link: https://github.com/articaST/integriaims Affected...

Logitech Keystroke Injection Flaw Went Unaddressed for Months

Computer peripheral giant Logitech has finally issued a patched version of its Logitech Options desktop app, after being taken to task for a months-old security flaw. The bug could have allowed adversaries to launch keystroke injection attacks against Logitech keyboard owners that used the app...

PHP Server Monitor 3.3.1 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: PHP Server Monitor 3.3.1 - Cross-Site Request Forgery Exploit Author: Javier Olmedo Website: https://www.sidertia.com Google Dork: N/A Vendor: https://www.phpservermonitor.org/ Software Link:...

WordPress Plugin 'AMP for WP - Accelerated Mobile Pages' < 0.9.97.20 Multiple Vulnerabilities

The WordPress application running on the remote host has a version of the 'AMP for WP - Accelerated Mobile Pages' plugin that is prior to 0.9.97.20 and, thus, is affected by multiple vulnerabilities. The most severe of which would allow a low level user to modify any request to call AJAX hooks an...

mooSocial Store Plugin 2.6 - SQL Injection

mooSocial Store Plugin 2.6 - SQL Injection Exploit Title: mooSocial Store Plugin 2.6 - SQL Injection Exploit Author: Andrea Bocchetti Date: 2018-08-28 Google Dork: N/A - Vendor: https://moosocial.com/product/store-plugins/ Software Link: https://moosocial.com/product/store-plugins/ Demo URL:...

mooSocial Store 2.6 SQL Injection

Exploit Title: mooSocial Store Plugin 2.6 - SQL Injection Exploit Author: Andrea Bocchetti Date: 2018-08-28 Google Dork: N/A - Vendor: https://moosocial.com/product/store-plugins/ Software Link: https://moosocial.com/product/store-plugins/ Demo URL: http://addons.moosocial.com/stores Purchase lin...

WordPress Export Users to CSV plugin <= 1.1.1 - CSV Injection vulnerability

CSV Injection vulnerability found by Javier Olmedo in WordPress Export Users to CSV plugin versions = 1.1.1. Solution 2018.09.01 - we were unable to find a patched version of this plugin...

WordPress Chained Quiz 1.0.8 SQL Injection

Exploit Title: WordPress Plugin Chained Quiz 1.0.8 - 'answer' SQL Injection Exploit Author: Alirim Emini Website: https://www.sentry.co.com Software Link: https://wordpress.org/plugins/chained-quiz/ Version/s: 1.0.8 and below Patched Version: 1.0.9 CVE : N/A WPVULNDB:...

WordPress Chained Quiz 1.0.8 Plugin - answer SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress Plugin Chained Quiz 1.0.8 - 'answer' SQL Injection Exploit Author: Çlirim Emini Website: https://www.sentry.co.com Software Link: https://wordpress.org/plugins/chained-quiz/ Version/s: 1.0.8 and below Patched Version:...

WordPress Export Users To CSV 1.1.1 CSV Injection

Exploit Title: Wordpress Plugin Export Users to CSV 1.1.1 - CSV Injection Exploit Author: Javier Olmedo Website: https://hackpuntes.com Date: 2018-08-14 Google Dork: N/A Vendor: Matt Cromwell Software Link: https://wordpress.org/plugins/export-users-to-csv/ Affected Version: 1.1.1 and before Acti...

Atmosphere 1.x / 2.x Cross Site Scripting

COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: Atmosphere 1 Vendor: Async-IO.org CSNC ID: CSNC-2018-023 Subject: Reflected Cross-Site Scripting XSS Risk: High Effect: Remotely exploitable Author: Lukasz D. [email protected] Date: 13.08.2018...

Zeta Producer Desktop CMS 14.2.0 - Remote Code Execution / Local File Disclosure

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Remote Code Execution & Local File Disclosure product: Zeta Producer Desktop CMS vulnerable version: =14.2.1 CVE number: CVE-2018-13981, CVE-2018-13980 impact: critical...