July 2013 Security Bulletin Webcast, Q&A, and Slide Deck

Today we’re publishing the July 2013 Security Bulletin Webcast Questions & Answers page. During the webcast, we fielded 10 questions covering all updates. All questions are included on the Q&A page. We invite our customers to join us for the next scheduled webcast on Wednesday, August 14th at 11...

June 2013 Security Bulletin Webcast, Q&A, and Slide Deck

Today we’re publishing the June 2013 Security Bulletin Webcast Questions & Answers page. We fielded three questions during the webcast, with specific questions focusing primarily on Windows Print Spooler MS13-050, Microsoft Office MS13-051, and the security advisory addressing digital certificate...

WordPress Content Slide插件跨站请求伪造漏洞

CVE-2013-2708 Content Slide是WordPress软件基金会的一款插件。可在WordPress网站的任何地方创建完全自定义的jquery Fading图像幻灯片。 WordPress的Content Slide插件中存在跨站请求伪造漏洞。远程攻击者可利用该漏洞在受影响应用程序上下文中执行某些未授权操作，也可能存在其他形式的攻击。Content Slide 1.4.2版本中存在漏洞，其他版本也可能受到影响。 0 WordPress Content Slide 目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： http://wordpress.org/...

No-IP Dynamic Update Client 2.1.9 Stack Overflow

!/usr/bin/env python Title: No-IP Dynamic Update Client DUC 2.1.9 local IPaddress stack overflow Author: Alberto Ortega @a0rtega [email protected] Date: May 11 2013 vulnerability discovered Background: No-IP is probably the most used Dynamic DNS provider worldwide, their Dynamic Update Client D...

Cross site scripting

Cross-site scripting XSS vulnerability in the 3 slide gallery in the Company theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the 3 slide gallery in the Fresh theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the 3 slide gallery in the Professional theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-1785

Cross-site scripting XSS vulnerability in the 3 slide gallery in the Premium Responsive theme before 7.x-1.6 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-1779

Cross-site scripting XSS vulnerability in the 3 slide gallery in the Fresh theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-1787

Cross-site scripting XSS vulnerability in the 3 slide gallery in the Simple Corporate theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-1779

Cross-site scripting XSS vulnerability in the 3 slide gallery in the Fresh theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-1786

CVE-2013-1786 is a Drupal-related XSS in the contributed Company Theme before 7.x-1.4. The vulnerability lies in the 3 slide gallery not properly sanitizing user-entered content, enabling remote authenticated users with the administer themes permission to inject arbitrary script/HTML via unspecif...

CVE-2013-1781

The CVE-2013-1781 entry affects Drupal’s Professional Theme prior to 7.x-1.4. The vulnerability is an XSS in the 3 slide gallery where unsanitized user content can be injected by remote authenticated users with administer themes permission via unspecified vectors. Affected software: Professional ...

CVE-2013-1786: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the 3 slide gallery in the Company theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-1784: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the 3 slide gallery in the Clean Theme before 7.x-1.3 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-1787: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the 3 slide gallery in the Simple Corporate theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-1785: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the 3 slide gallery in the Premium Responsive theme before 7.x-1.6 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors...

SA-CONTRIB-2013-030 - Clean Theme - Cross Site Scripting (XSS)

This third-party contributed theme change Drupal's interface. The theme doesn't properly sanitize user-entered content in the 3 slide gallery on the homepage leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker would have to have the...

SuSE 11.2 Security Update : LibreOffice (SAT Patch Number 6804)

LibreOffice was updated to SUSE 3.5 bugfix release 13 based on upstream 3.5.6-rc2 which fixes a lot of bugs. The following bugs have been fixed : - polygon fill rule. bnc759172 - open XML in Writer. bnc777181 - undo in text objects fdo36138 - broken numbering level. bnc760019 - better MathML...

aspcms background holding shell vulnerability(non-add module)and repair method-vulnerability warning-the black bar safety net

aspcms in the old version, you can add a template directly to add the asp. But the new aspcms has been restricted to add the template format is html,js,css,and of course if you are experiencing iis6 words or by iis6 parsing vulnerability put the file name into 1. asp;. html this format to get to...