WordPress GD Star Rating插件跨站请求伪造漏洞

WordPress是一款内容管理系统。 由于应用程序允许用户通过未经验证的HTTP请求执行某些操作，攻击者可以利用漏洞当一个登录的管理用户访问特制的网页时更改插件的配置。 0 WordPress GD Star Rating Plugin 1.x 目前没有详细解决方案： http://wordpress.org/...

GD Star Rating 1.9.22 XSS / CSRF / SQL Injection

Details ================ Software: GD Star Rating Version: 1.9.22 Homepage: http://wordpress.org/plugins/gd-star-rating/ CVSS: 8.5 High; AV:N/AC:L/Au:S/C:C/I:N/A:C Description ================ XSS, CSRF and blind SQL injection in GD Star Rating 1.9.22 Vulnerability ================ This plugin is...

ESA-2014-011: RSA BSAFE® Micro Edition Suite Server Crash Vulnerability

ESA-2014-011.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-011: RSA BSAFE® Micro Edition Suite Server Crash Vulnerability EMC Identifier: ESA-2014-011 CVE Identifier: CVE-2014-0628 Severity Rating: CVSS v2 Base Score: 5.4 AV:N/AC:H/Au:N/C:N/I:N/A:C Affected Products: RSA BSAFE Micro...

ESA-2014-005: EMC Documentum Foundation Services (DFS) Content Access Vulnerability

ESA-2014-005.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-005: EMC Documentum Foundation Services DFS Content Access Vulnerability EMC Identifier: ESA-2014-005 CVE Identifier: CVE-2014-0622 Severity Rating: CVSS v2 Base Score: 9 AV:N/AC:L/Au:S/C:C/I:C/A:C Affected products: • EMC DF...

Adobe Updates Flash, Reader, Acrobat on Patch Tuesday

Adobe has issued security bulletins addressing five critical vulnerabilities in its Flash, Reader and Acrobat Players that could give attackers the ability to cause crashes and wrest control of affected machines. Adobe claims it is not aware of any in-the-wild exploits targeting these bugs...

ESA-2013-047: RSA® Authentication Agent for PAM Unlimited Login Attempts Vulnerability

ESA-2013-047.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-047: RSA® Authentication Agent for PAM Unlimited Login Attempts Vulnerability EMC Identifier: ESA-2013-047 CVE Identifier: CVE-2013-3271 Severity Rating: CVSS v2 Base Score: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Affected Products: R...

Assessing risk for the October 2013 security updates

Today we released eight security bulletins addressing 25 CVE’s. Four bulletins have a maximum severity rating of Critical while the other four have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your...

Adobe Prepping October Patches for Reader, Acrobat

Adobe has announced that it plans to patch critical vulnerabilities in two products, Adobe Reader and Acrobat XI 11.0.04 for Windows, next week as part of its monthly Patch Tuesday updates. Adobe posted about the impending updates yesterday on its Product Security Incident Response Team PSIRT blo...

July 2013 Adobe Security Bulletins, Patches Released

Adobe today released its monthly round of security updates with patches available for Flash Player, Shockwave and ColdFusion. None of the vulnerabilities are being exploited in the wild, according to Adobe. The flaws in Flash Player and Shockwave could allow hackers to remotely install and run...

phpwind9 给自己评分

简要描述： pw9的评分未在后台对评分对象做验证，仅做了前台隐藏，因此可以给自己评分。 详细说明： pw9评分功能仅在前台对自己的帖子隐藏了评分功能，但通过将别的评分form的pid改为自己的帖子的pid，依然能够实现对自己帖子的评分，从而实现刷分。 漏洞证明： 虽然说，在前台自己的帖子没有评分按钮。但是随便点开一个其他帖子的评分 然后把弹出的评分窗口的pid改为自己随意一个帖子的pid，点击提交 评分成功，积分到手...

Groovy Media Player 3.2.0 Buffer Overflow Vulnerability

Groovy Media Player version 3.2.0 suffers from a buffer overflow vulnerability. Title: ==== Groovy Media Player 3.2.0 Buffer Overflow Vulnerability Credit: ====== Name: Akshaysinh Vaghela Company/affiliation: Cyberoam Technologies Private Limited Website: www.cyberoam.com CVE: ===== CVE-2013-2760...

Groovy Media Player 3.2.0 Buffer Overflow

Title: ==== Groovy Media Player 3.2.0 Buffer Overflow Vulnerability Credit: ====== Name: Akshaysinh Vaghela Company/affiliation: Cyberoam Technologies Private Limited Website: www.cyberoam.com CVE: ===== CVE-2013-2760 Reserved Date: ==== 21-03-2013 CL-ID: ==== CRD-2013-02 Vendor: ======...

SynConnect Pms - index.php?loginid SQL Injection

SynConnect Pms - index.php?loginid SQL Injection Title: ==== SynConnect - SQL Injection vulnerability Credit: ====== Name: Bhadresh Patel Company/affiliation: Cyberoam Technologies Private Limited Website: www.cyberoam.com CVE: ===== Date: ==== 01-03-2013 CRD: ==== CRD-2013-01 Vendor: ======...

GD Star Rating Plugin for WordPress 'export.php' Authentication Bypass Information Disclosure

The GD Star Rating Plugin for WordPress installed on the remote host is affected by a security bypass information disclosure vulnerability. The issue is triggered when the 'plugins/gd-star-rating/export.php' script fails to properly verify user authentication, which allows a remote attacker to...

ESA-2013-012: RSA® Authentication Agent 7.1.1 for Microsoft Windows® Access Control Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-012: RSA® Authentication Agent 7.1.1 for Microsoft Windows® Access Control Vulnerability EMC Identifier: ESA-2013-012 CVE Identifier: CVE-2013-0931 Severity Rating: CVSS v2 Base Score: 6.0 AV:N/AC:M/Au:S/C:P/I:P/A:P Affected Products: Product...

WordPress Comment Rating 2.9.32 SQL Injection / Bypass

Exploit Title: Wordpress plugin: Comment Rating SQL injection Google Dork: Date: 21/02/2013 Exploit Author: ebanyu Url Author: www.ebanyu.com.ar Vendor Homepage: wealthynetizen.com Software Link: http://wealthynetizen.com/wordpress-plugin-comment-rating/ Version: 2.9.32 Tested on: Fedora 18 + mys...

WordPress Plugin Comment Rating 2.9.32 - Multiple Vulnerabilities

WordPress Plugin Comment Rating 2.9.32 - Multiple Vulnerabilities Exploit Title: Wordpress plugin: Comment Rating SQL injection Google Dork: Date: 21/02/2013 Exploit Author: ebanyu Url Author: www.ebanyu.com.ar Vendor Homepage: wealthynetizen.com Software Link:...

Wordpress Comment Rating Plugin 2.9.32 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Wordpress plugin: Comment Rating SQL injection Google Dork: Date: 21/02/2013 Exploit Author: ebanyu Url Author: www.ebanyu.com.ar Vendor Homepage: wealthynetizen.com Software Link:...

WordPress Comment Rating Plugin 2.9.32 - Multiple Vulnerabilities

This Comment Rating plugin is prone to multiple vulnerabilities such as comment rating SQL injection and BYPASS. Solution Update the plugin...

WordPress Plugin Comment Rating 2.9.32 - Multiple Vulnerabilities

Exploit Title: Wordpress plugin: Comment Rating SQL injection Google Dork: Date: 21/02/2013 Exploit Author: ebanyu Url Author: www.ebanyu.com.ar Vendor Homepage: wealthynetizen.com Software Link: http://wealthynetizen.com/wordpress-plugin-comment-rating/ Version: 2.9.32 Tested on: Fedora 18 + mys...