WordPress 1-Click Retweet/Share/Like 5.2 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Title: WordPress '1-click Retweet/Share/Like' Plugin Version: 5.2 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-21 Download: - https://wordpress.org/plugins/1-click-retweetsharelike/ -...

[SECURITY] Fedora 22 Update: openvas-libraries-8.0.3-2.fc22

openvas-libraries is the base library for the OpenVAS network security scanner...

OracleVM 3.3 : openssl (OVMSA-2015-0070)

The remote OracleVM system is missing necessary patches to address critical security updates : - improved fix for CVE-2015-1791 - add missing parts of CVE-2015-0209 fix for corectness although unexploitable - fix CVE-2014-8176 - invalid free in DTLS buffering code - fix CVE-2015-1789 -...

Amazon Linux AMI : php56 (ALAS-2015-536)

An integer underflow flaw leading to out-of-bounds memory access was found in the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened. CVE-2015-4021 An integer overflow flaw leading to a heap based...

eFront < 3.6.15.4 Build 18023 Multiple Vulnerabilities

According to its version number, the version of eFront running on the remote web server is affected by multiple vulnerabilities : - A path traversal vulnerability exists due to improper sanitization of user-supplied input to the 'file' parameter of the viewfile.php script. A remote attacker can...

Fortinet FortiManager 5.0.x < 5.0.11 / 5.2.x < 5.2.2 Multiple Vulnerabilities (FG-IR-15-011)

The remote host is running a version of FortiManager that is 5.0.x prior to 5.0.11 or 5.2.x prior 5.2.2. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists that allows an unauthenticated, remote attacker to inject arbitrary OS commands. CVE-2015-3611 - A...

Wordpress Twenty Fifteen Theme - DOM XSS Vulnerability - CVE-2015-3429

Information -------------------- Advisory by Netsparker. Name: DOM XSS Vulnerability in Twenty Fifteen WordPress Theme Affected Software : WordPress Affected Versions: 4.2.1 and probably below Vendor Homepage : https://wordpress.org/ and https://wordpress.org/themes/twentyfifteen/ Vulnerability...

WordPress Twenty Fifteen 4.2.1 Cross Site Scripting

Information -------------------- Advisory by Netsparker. Name: DOM XSS Vulnerability in Twenty Fifteen WordPress Theme Affected Software : WordPress Affected Versions: 4.2.1 and probably below Vendor Homepage : https://wordpress.org/ and https://wordpress.org/themes/twentyfifteen/ Vulnerability...

Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2015-516)

An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox...

FreeBSD : Several vulnerabilities found in PHP (742563d4-d776-11e4-b595-4061861086c1)

The PHP project reports : The PHP development team announces the immediate availability of PHP 5.6.7. Several bugs have been fixed as well as CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331. All PHP 5.6 users are encouraged to upgrade to this version. The PHP development team announces the immedia...

WEBGATE ActiveX Controls Multiple Buffer Overflows

The remote host contains one or more of the following WEBGATE ActiveX controls : - Control Center : - FileConverter.FileConverterCtrl.1 - LoginContoller.LoginControllerCtrl.1 - WESPDiscovery.WESPDiscoveryCtrl.1 - WESPPlayback.WESPPlaybackCtrl.1 - eDVR Manager : - WESPDiscovery.WESPDiscoveryCtrl.1...

Oracle MySQL 5.6.x < 5.6.22 Multiple Vulnerabilities

Binary data 8920.prm...

Google releases Cloud-based Web App Vulnerability Scanner and Assessment Tool

Google on Thursday unleashed its own free web application vulnerability scanner tool, which the search engine giant calls Google Cloud Security Scanner, that will potentially scan developers' applications for common security vulnerabilities on its cloud platform more effectively. SCANNER ADDRESSE...

MantisBT 1.2.13 < 1.2.18 XSS

Binary data 8906.prm...

Amazon Linux AMI : curl (ALAS-2015-477)

The curleasyduphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPTCOPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information. CVE-2014-3707 CR...

Amazon Linux AMI : httpd24 (ALAS-2015-483)

modlua.c in the modlua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access...

Blubrry PowerPress Security Advisory - XSS Vulnerability - CVE-2015-1385

Information ------------ Advisory by Netsparker Name: XSS Vulnerability in Blubrry PowerPress Affected Software : Blubrry PowerPress Affected Versions: 6.0 and possibly below Vendor Homepage : https://wordpress.org/plugins/powerpress/ Vulnerability Type : Cross-site Scripting Severity : Important...

Blubrry PowerPress 6.0 Cross Site Scripting

Information ------------ Advisory by Netsparker Name: XSS Vulnerability in Blubrry PowerPress Affected Software : Blubrry PowerPress Affected Versions: 6.0 and possibly below Vendor Homepage : https://wordpress.org/plugins/powerpress/ Vulnerability Type : Cross-site Scripting Severity : Important...

MyBB < 1.6.14 DoS

Binary data 8630.prm...

Oracle Solaris Third-Party Patch Update : lighttpd (multiple_vulnerabilities_in_lighttpd)

The remote Solaris system is missing necessary patches to address security updates : - SQL injection vulnerability in modmysqlvhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to requestcheckhostname. CVE-2014-2323 - Multiple...