CVE-2014-5451

CVE-2014-5451 is a reflected XSS in MODX Revolution prior to or equal to 2.3.1-pl, caused by insufficient sanitization of input data passed via the HTTP GET parameter a to the path /manager/. The issue affects MODX Revolution v2.3.1-pl and earlier; exploitation can trick an admin to click a craft...

CVE-2014-5451

Cross-site scripting XSS vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or HTML via the "a" parameter to manager/. NOTE: this issue exists because of a CVE-2014-2080 regression...

CVE-2014-5451: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or HTML via the "a" parameter to manager/. NOTE: this issue exists because of a CVE-2014-2080 regression...

MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass / Reflected Cross-Site Scripting / Persistent Cross-Site Scripting

Advisory ID: 92152 Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.0.0–2.2.14 Tested Version: 2.2.14 Advisory Publication: 16 July, 2014 without technical details Vendor Notification: 16 July, 2014 Vendor Patch: 15 July, 2014 Public Disclosure: 2 November , 2014 Vulnerability Type:...

MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass Reflected Cross-Site Scripting Persistent Cross-Site Scripting

MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass Reflected Cross-Site Scripting Persistent Cross-Site Scripting Advisory ID: 92152 Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.0.0–2.2.14 Tested Version: 2.2.14 Advisory Publication: 16 July, 2014 without technical details Vendor...

MODX Revolution 2.2.14 CSRF / XSS Vulnerabilities

MODX Revolution version 2.2.14 suffers from reflective cross site scripting, persistent cross site scripting, and cross site request forgery vulnerabilities. Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.0.0–2.2.14 Tested Version: 2.2.14 Advisory Publication: 16 July, 2014 without...

CVE-2014-7632: Undefined Security Weakness

The news revolution - bahrain aka com.news.revolution.BH application 3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Reflected Cross-Site Scripting (XSS) in MODX Revolution

Advisory ID: HTB23229 Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.3.1-pl and probably prior Tested Version: 2.3.1-pl Advisory Publication: August 20, 2014 without technical details Vendor Notification: August 20, 2014 Vendor Patch: September 11, 2014 Public Disclosure: September...

MODX Revolution 2.3.1-pl Cross Site Scripting Vulnerability

MODX Revolution version 2.3.1-pl suffers from a reflective cross site scripting vulnerability. Vendor: MODX Vulnerable Versions: 2.3.1-pl and probably prior Tested Version: 2.3.1-pl Advisory Publication: August 20, 2014 without technical details Vendor Notification: August 20, 2014 Vendor Patch:...

WordPress Slider Revolution - Local File Disclosure

Description Note: The Construct, Echelon, Fusion, Method, Modular and Myriad affected themes are from the Mysitemyway, who went out of business, and the themes have been forked by BackStop Themes who does not use Revslider...

MODX Revolution 2.3.1-pl Cross Site Scripting

Advisory ID: HTB23229 Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.3.1-pl and probably prior Tested Version: 2.3.1-pl Advisory Publication: August 20, 2014 without technical details Vendor Notification: August 20, 2014 Vendor Patch: September 11, 2014 Public Disclosure: September...

VulnCheck KEV: CVE-2014-9734

Directory traversal vulnerability in the Slider Revolution revslider plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php...

WordPress Slider Revolution Arbitrary File Download Vulnerability

WordPress Slider Revolution is prone to an arbitrary file download vulnerability SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Reflected Cross-Site Scripting (XSS) in MODX Revolution

High-Tech Bridge Security Research Lab discovered vulnerability in MODX Revolution, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Reflected Cross-Site Scripting XSS in MODX Revolution: CVE-2014-5451 The vulnerability exists due to insufficient sanitization of input data...

Wordpress Slider Revolution Responsive <= 4.1.4 Arbitrary File Download

Exploit for php platform in category web applications Exploit Title : Wordpress Slider Revolution Responsive = 4.1.4 Arbitrary File Download Exploit Author : Claudio Viviani Vendor Homepage : http://codecanyon.net/item/slider-revolution-responsive-wordpress-plugin/2751380 Software Link : Premium...

WordPress Slider Revolution Responsive 4.1.4 File Download

 Exploit Title : Wordpress Slider Revolution Responsive = 4.1.4 Arbitrary File Download Exploit Author : Claudio Viviani Vendor Homepage : http://codecanyon.net/item/slider-revolution-responsive-wordpress-plugin/2751380 Software Link : Premium plugin Dork Google: revslider.php "index of" Date ...

Critical Login XSS+CSRF Revolution 2.2.1.4 and Prior

Product: MODX Revolution Severity: Critical Versions: 2.0.0–2.2.14 Vulnerability type: CSRF & XSS Report date: 2014-Jul-10 Fixed date: 2014-Jul-15 Description A significant vulnerability was discovered in the Manager login of MODX Revolution that also affects the use of the Login Extra. A malicio...

Post Revolution <= 0.7.0 RC 2 (dir) Remote File Inclusion Vulnerability

No description provided by source. Post Revolution Remote File Inclusion Affected Software .: Post Revolution 6.6 / 7.0 Release Candidate 2 Download..: http://www.fabio.com.ar/postrev/ Risk ..............: high Date .........: 25/3/2007 Found by ..........: InyeXion Contact ...........:...

Fashione E-Commerce Webshop Multiple SQL Injection Vulnerability

No description provided by source. / / / / / / / / / / // / / / / ///// // Exploit Title: Fashione E-Commerce Webshop Multiple SQL Injection Vulnerabilities Date: 2010-09-19 Author: secret Contact : [email protected] / ICQ : 17-33-77 Site : swissfaking.net/board Software Link:...

REvolution <= 10.02 CSRF (Cross-Site Request Forgery)

No description provided by source. Vulnerability ID: HTB22367 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinnpdsrevolution.html Product: NPDS REvolution Vendor: NPDS Vulnerable Version: REvolution 10.02 and Probably Prior Versions Vendor Notification: 06 May 2010 Vulnerability Type: CSRF...