WordPress Plugin Huge IT Slider SQL Injection Vulnerability

WordPress is a use of PHP language development blog platform, users can support PHP and MySQL database server set up their own weblog. A SQL injection vulnerability exists in the WordPress plugin Huge IT Slider. The vulnerability is caused due to the failure to filter input passed to the...

Atmail Webmail 7.5 - Multiple Vulnerabilities

Atmail is a commercial Linux messaging platform provider, the company develops webmail service known as Atmail Webmail. Latest version of Atmail, including desktop and mobile versions, suffers on multiple XSS and CSRF vulnerabilities, which may lead to account takeover. Attacker is able to inject...

WordPress plugin Timed Popup (wp-timed-popup) cross-site request forgery vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability in WordPress plugin Timed Popup wp-timed-popup versions prior to 1.3 allows remote...

CVE-2014-9525

Multiple cross-site request forgery CSRF vulnerabilities in the Timed Popup wp-timed-popup plugin 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or 2 conduct cross-site scripting XSS attack...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Timed Popup wp-timed-popup plugin 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or 2 conduct cross-site scripting XSS attack...

CVE-2014-9525

Multiple cross-site request forgery CSRF vulnerabilities in the Timed Popup wp-timed-popup plugin 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or 2 conduct cross-site scripting XSS attack...

CVE-2014-9525

CVE-2014-9525 affects the WordPress Timed Popup (wp-timed-popup) plugin v1.3. It contains CSRF vulnerabilities that allow remote attackers to hijack administrator authentication to change plugin settings via unspecified vectors, and also to perform XSS through the sc_popup_subtitle parameter on w...

WordPress Timed Popup Plugin <= 1.3 - Multiple CSRF and XSS

Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution Update the plugin...

Timed Popup <= 1.3 - CSRF & Stored XSS

The wp-timed-popup WordPress plugin was affected by a CSRF & Stored XSS security vulnerability...

WP Popup <= 1.3 - XSS & CSRF

It is unclear if the issues have been fixed. Plugin has been closed...

WordPress Timed Popup 1.3 CSRF / XSS

Title: WordPress 'Timed Popup' plugin - CSRF/XSS Version: 1.3 Author: Morten Nørtoft, Kenneth Jepsen, Mikkel Vej Date: 2014/12/12 Download: https://wordpress.org/plugins/wp-timed-popup/ Notified WordPress: 2014/11/27 ---------------------------------------------------------------- Description:...

Cardoza Facebook Like Box < 2.8.3 - Multiple CSRF

The Easy Social Like Box – Popup – Sidebar Widget WordPress plugin was affected by a Multiple CSRF security vulnerability...

Webmin < 1.690 Multiple XSS

According to its self-reported version, the Webmin install hosted on the remote host is prior to version 1.690. It is, therefore, affected by multiple cross-site scripting vulnerabilities : - The application is affected by multiple unspecified cross-site scripting vulnerabilities. CVE-2014-3885 -...

DEBIAN-CVE-2014-0483

The administrative interface contrib.admin in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a tofield...

Crlf injection

The administrative interface contrib.admin in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a tofield...

PYSEC-2014-7

The administrative interface contrib.admin in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a tofield...

UBUNTU-CVE-2014-0483

The administrative interface contrib.admin in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a tofield...

Debian Security Advisory DSA 3010-1 (python-django - security update)

Several vulnerabilities were discovered in Django, a high-level Python web development framework. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2014-0480 Florian Apolloner discovered that in certain situations, URL reversing could generate scheme-relative...

Simple Popup - popup.php z Parameter XSS

The Simple PopUp WordPress plugin was affected by a popup.php z Parameter XSS security vulnerability...

Facebook Popup Trigger (Turn your visitors to visit your sites automatically)

To all spammy, you couldn't share your flagged links on facebook? Don't worry, with this instruction, you can by pass to share the link. This is not just only about bypass of linkshrim. This is all about opening Popup of any of your pages to open for your visitors as well. All you need is "https"...