WordPress Social Locker Plugin <= 4.2.0 - Reflected Cross Site Scripting

Because of this vulnerability, authenticated administrators can inject HTML or JS code. Solution Update the plugin...

[SYSS-2015-041] XSS in OpenText Secure MFT

Advisory ID: SYSS-2015-041 Product: Secure MFT Vendor: OpenText Affected Versions: 2013 R1, 2014 R1, 2014 R2 Tested Versions: 2014 R2 SP4 Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium Solution Status: Fixed Vendor Notification: 2015-08-05 Solution Date: 2015-08-14 Public...

Pornhub: [reflected xss, pornhub.com] /blog, any

The researcher identified that the following URL for the Pornhub blog was vulnerable to reflected/semi-stored cross site scripting, which enabled the researcher to craft a URL that pops multiple alert boxes as the page is loading. The affected url can be seen below:...

Ninja Forms <= 2.9.21 - Authenticated Reflected Cross-Site Scripting (XSS)

The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-admin/admin.php?page=nf-processing=...

BlueDragon 6.2.1 / 7.0 / 7.1 Cross Site Scripting

I. VULNERABILITY BlueDragon 6.2.1, 7.0, 7.1 Reflected Cross-Site Scripting II. SOURCE: http://www.newatlanta.com/c/products/bluedragon/download/home III. BACKGROUND BlueDragon is a family of runtime server-side products for the deployment of ColdFusion Markup Language CFML pages - with native...

OSF for Drupal - Critical - Multiple vulnerabilities - SA-CONTRIB-2015-134

The Open Semantic Framework OSF for Drupal is a middleware layer that allows structured data RDF and associated vocabularies ontologies to "drive" tailored tools and data displays within Drupal. The module is vulnerable to reflected Cross Site Scripting XSS because it did not sufficiently filter...

NewStatPress <= 1.0.4 - Reflected Cross-Site Scripting (XSS)

The NewStatPress plugin utilizes on lines 28 and 31 of the file ‘includes/nspsearch.php’ several variables from the $GET scope, without sanitation. While WordPress automatically escapes quotes on this scope, the outputs on these lines are outside of quotes, and as such can be utilized to trigger ...

Simple Share Buttons Adder <= 6.0.0 - Reflected Cross-Site Scripting (XSS)

A reflected XSS in "Simple Share Buttons Adder" before version 6.0.1 lead to a reflected cross-site scripting vulnerability on all pages where the "Simple Share Buttons Adder" was added usually all blog posts. Exploitation required that the browser did not encode the parameters sent to the server...

WordPress Videowall Plugin - Reflected Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability in index.php pageid parameter. Solution Update the plugin...

WordPress Encrypted Blog Plugin <= 0.0.6.2 - Reflected Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability via encryptblogform.php redirectto parameter. Solution Update the plugin...

WSO2 Identity Server 5.0.0 XSS / CSRF / XXE Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple critical vulnerabilities product: WSO2 Identity Server other WSO2 Carbon based products may be affected too...

Citizen Space <= 1.1 - Reflected Cross-Site Scripting (XSS)

The citizen-space WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...

APSB15-08 Security bulletin available for Adobe Flex

An important vulnerability has been identified in the JavaScript output of the ASDoc tool available in Adobe Flex 4.6 and earlier versions. This vulnerability could lead to reflected cross-site scripting. Adobe recommends users perform the actions referenced in the "Solutions" section below to...

Ptengine <= 1.0.1 - Reflected Cross-Site Scripting (XSS)

The ptengine-real-time-web-analytics-and-heatmap WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/?account=1=1=1=0=1=1=1=1=1=PHNjcmlwdD5hbGVydCgnYnJva2VuIScpOzwvc2NyaXB0Pg== payload is base64 encoded in the code parameter...

Ptengine <= 1.0.1 - Reflected Cross-Site Scripting (XSS)

The ptengine-real-time-web-analytics-and-heatmap WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...

SEC Consult SA-20150227-0 :: Multiple vulnerabilities in Loxone Smart Home

SEC Consult Vulnerability Lab Security Advisory 20150227-0 ======================================================================= title: Multiple vulnerabilities product: Loxone Smart Home vulnerable version: Firmware: 5.49; Android-App: 3.4.1 fixed version: 6.3 impact: High homepage:...

NetIQ Access Manager 4.0 < 4.0 SP1 Hotfix 3 Multiple Vulnerabilities

The remote host is running a version of NetIQ Access Manager 4.0 without service pack 1 hotfix 3. It is, therefore, affected by the following vulnerabilities : - An XML Entity Injection XXE flaw exists in the 'query' parameter of the webacc servlet that can allow an authenticated user to view the...

FortiAuthenticator v300 build 0007 Multiple Vulnerabilities

Fortinet FortiAuthenticator suffers from subshell bypass, cross site scripting, password disclosure, and file disclosure vulnerabilities. Fortinet FortiAuthenticator Multiple Vulnerabilities Affected Versions: Verified on FortiAuthenticator v300 build 0007 +-------------+ | Description |...

Gecko CMS 2.3 - Multiple Vulnerabilities

Gecko CMS 2.3 - Multiple Vulnerabilities Gecko CMS 2.3 Multiple Vulnerabilities Vendor: JAKWEB Product web page: http://www.cmsgecko.com Affected version: 2.3 and 2.2 Summary: Gecko CMS is the way to go, forget complicated, bloated and slow content management systems, Gecko CMS has been build to...

Gecko CMS 2.3 Multiple Vulnerabilities

Summary Gecko CMS is the way to go, forget complicated, bloated and slow content management systems, Gecko CMS has been build to be intuitive, easy to use, extendable to almost anything, running on all standard web hosting PHP and one MySQL database, Apache is a plus, browser compatibility and...