All In One Schema.org Rich Snippets <= 1.4.4 - Authenticated Cross-Site Scripting (XSS)

The Schema – All In One Schema Rich Snippets WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability. PoC http://vulnerablesite.com/wp-admin/admin.php?page=richsnippetdashboardforcesend=truesendlabel=...

All In One Schema.org Rich Snippets <= 1.4.4 - Authenticated Cross-Site Scripting (XSS)

The Schema – All In One Schema Rich Snippets WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability. http://vulnerablesite.com/wp-admin/admin.php?page=richsnippetdashboard&bsfforcesend=true&bsfsendlabel=alert1...

AXIS Communications - Cross-Site Scripting / Content Injection

0RWELLL4BS security advisory olsa-2015-8258 PGP: 79A6CCC0 @orwelllabs Advisory Information ==================== - Title: ImagePath Resource Injection/Open script editor - Vendor: AXIS Communications - Research and Advisory: Orwelllabs - Class: Improper Input Validation CWE-20 - CVE Name:...

Fortinet FortiClient 5.2.3 (Windows 10 x86) - Local Privilege Escalation

/ Check these out: - https://www.coresecurity.com/system/files/publications/2016/05/Windows%20SMEP%20bypass%20U%3DS.pdf - https://labs.mwrinfosecurity.com/blog/a-tale-of-bitmaps/ Tested on: - Windows 10 Pro x86 1703/1709 - ntoskrnl.exe: 10.0.16299.309 - FortiShield.sys: 5.2.3.633 Compile: -...

GitLab: Users with guest access can post notes to private merge requests, issues, and snippets

Vulnerability details A user with guest access to a group / project can post notes to private merge requests, issues, and snippets. Impact It seems it only allows an attacker to post notes to objects that the user doesn't have access to. I tried creating notes with slash commands, but unfortunate...

BORG - Terminal Based Search For Bash Snippets

Borg was built out of the frustration of having to leave the terminal to search and click around for bash snippets. Borg's succint output also makes it easy to glance over multiple snippets quickly. Search borg "find all txt" 1 Find and delete .txt files in bash a find . -name ".txt" | xargs rm b...

Google Analytics - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2016-042

This module enables you to add integration with Google Analytics statistics service. The module allows admin users to enter custom JavaScript snippets to add advanced tracking functionality. The permission required to enter this JavaScript was not marked as restricted. This vulnerability is...

WordPress Code Snippets 2.6.1 Cross Site Scripting

------------------------------------------------------------------------ Cross-Site Scripting in Code Snippets WordPress Plugin ------------------------------------------------------------------------ Burak Kelebek, July 2016 -----------------------------------------------------------------------...

WordPress Code Snippets Plugin <= 2.6.1 - Cross Site Scripting

Because of this vulnerability, attacker can inject malicious JavaScript code into the application. Solution Update the plugin...

HNB 1.9.18-10 - Local Buffer Overflow

HNB 1.9.18-10 - Local Buffer Overflow Exploit developed using Exploit Pack v5.4 Exploit Author: Juan Sacco - http://www.exploitpack.com - [email protected] Program affected: HNB - Organizer Version: 1.9.18-10 Tested and developed under: Kali Linux 2.0 x86 - https://www.kali.org Program...

GitLab: Private snippets in public / internal projects leaked though GitLab API

Vulnerability details The /projects/:id/snippets resource leaks private snippets that were posted in a public or internal project. Proof of concept As a victim, create a new public or internal project. Lets state that the project has ID 1. Enable the snippets feature in the project settings and...

[SECURITY] Fedora 22 Update: drupal7-path_breadcrumbs-3.3-1.fc22

Path breadcrumbs module helps you to create breadcrumbs for any page with a ny selection rules and load any entity from the URL. Features Breadcrumbs navigation may be added to any kind of page: static example: node/1 or dynamic example: node/NID. You can load contexts from URL and use it like...

[SECURITY] Fedora 20 Update: drupal7-path_breadcrumbs-3.2-1.fc20

Path breadcrumbs module helps you to create breadcrumbs for any page with a ny selection rules and load any entity from the URL. Features Breadcrumbs navigation may be added to any kind of page: static example: node/1 or dynamic example: node/NID. You can load contexts from URL and use it like...

WordPress Ad-Manager 1.1.2 Open Redirect

CVE-2014-8754 WordPress “Ad-Manager Plugin” Dest Redirect Privilege Escalation Exploit Title: WordPress Ad-Manager Plugin Dest Redirect Privilege Escalation Vulnerability Product: WordPress Ad-Manager Plugin Vendor: CodeCanyon Vulnerable Versions: 1.1.2 Tested Version: 1.1.2 Advisory Publication:...

Pimcore CMS 1.4.9 2.1.0 - Multiple Vulnerabilities

Pimcore CMS 1.4.9 2.1.0 - Multiple Vulnerabilities Vulnerabilities in Pimcore 1.4.9 to 2.1.0 inclusive Discovered by Pedro Ribeiro [email protected] of Agile Information Security ==================================================================== Disclosure: 14/04/2014 / Last updated: 12/10/2014...

XOOPS Module WF-Snippets <= 1.02 (c) BLIND SQL Injection Exploit

No description provided by source. html head titleXOOPS Module WF-Snippets = 1.02 c BLIND SQL Injection Exploit/title script type=text/javascript //'=============================================================================================== //'Script Name: XOOPS Module WF-Snippets = 1.02 c...

AppFish Offline Coder v2.2 iOS - Persistent Vulnerability

Document Title: =============== AppFish Offline Coder v2.2 iOS - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1252 Release Date: ============= 2014-04-07 Vulnerability Laboratory ID VL-ID: ====================================...

Code Snippets 0.9 Insecure Session

--------------------------------------- Author : L3b-r1'z Title : Code Snippets Version 0,9 insecure session Date : 6/30/2012 Email : [email protected] Site : Sec4Ever.com & Exploit4arab.com Google Dork : allintext: "Powered by: PHP-CSL V0.9" Version : 1.1.0 6/30/2012 - Vulnerability discovered...

Joomla NoNumber Framework Local File Inclusion / Shell Upload

Exploit Title: NoNumber Framework Joomla! Plugin Multiple Vulnerabilities Discovery Date: 10 October 2011 Reported Date: 11 October 2011 Patch Date: 17 October 2011 Release Date: 17 October 2011 Author: jdc Software Link: http://nonumber.nl The nnframework plugin by NoNumber! contains multiple...

Disable Social Networks From Tracking You with The Priv3 Firefox Extension

Disable Social Networks From Tracking You with The Priv3 Firefox Extension In Earlier Post we Inform our readers about "Facebook track your cookies even after logout". Did you know that social networking sites like Facebook, Google+, and Twitter can track your visits to any web page that uses the...