4671 matches found
October CMS build cross-site scripting vulnerability
October CMS is an open source, self-hosted content management system CMS built on the Laravel PHP framework developed by Canadian software developer Alexey Bobkov and Australian software developer Samuel Georges. A cross-site scripting vulnerability in October CMS build 271 and earlier allows...
ColdFusion 9-10 - Credential Disclosure Exploit
ColdFusion...
Amazon Linux: Security Advisory (ALAS-2012-126)
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 21 Update: php-twig-1.20.0-1.fc21
The flexible, fast, and secure template engine for PHP. Fast: Twig compiles templates down to plain optimized PHP code. The overhead compared to regular PHP code was reduced to the very minimum. Secure: Twig has a sandbox mode to evaluate untrusted template code. This allows Twig to be used as a...
jakarta-taglibs-standard security update
0:1.1.1-11.7 - Gracefully handle parsers without FSP support e.g. Java 5 GCJ - Resolves: CVE-2015-0254 0:1.1.1-11.6 - Prevent XXE and RCE in JSTL XML tags - Apply correction for previous CVE-2015-0254 patch prevent XXE in - Resolves: CVE-2015-0254 0:1.1.1-11.5 - Prevent XXE and RCE in JSTL XML ta...
Vimeo: Stored XSS on player.vimeo.com
Description The page loaded for the Vimeo embedded player prints the Name of the owner of the video in Javascript context. Some characters are escaped, like " but others like , and - if the video is public - any Vimeo user can be affected by the Javascript code that is loaded. However, there is a...
[SECURITY] [DLA 294-1] wordpress security update
Package : wordpress Version : 3.6.1+dfsg-1deb6u7 CVE ID : CVE-2015-2213 CVE-2015-5622 CVE-2015-5731 CVE-2015-5732 CVE-2015-5734 Several vulnerabilities have been fixed in Wordpress, the popular blogging engine. CVE-2015-2213 SQL Injection allowed a remote attacker to compromise the site...
DLA-294-1 wordpress - security update
Bulletin has no description...
Debian DSA-3328-1 : wordpress - security update
Several vulnerabilities have been found in Wordpress, the popular blogging engine. - CVE-2015-3429 The file example.html in the Genericicons icon font package and twentyfifteen Wordpress theme allowed for cross site scripting. - CVE-2015-5622 The robustness of the shortcodes HTML tags filter has...
Debian DSA-3332-1 : wordpress - security update
Several vulnerabilities have been fixed in Wordpress, the popular blogging engine. - CVE-2015-2213 SQL Injection allowed a remote attacker to compromise the site. - CVE-2015-5622 The robustness of the shortcodes HTML tags filter has been improved. The parsing is a bit more strict, which may affec...
DSA-3328-1 wordpress - security update
Bulletin has no description...
CentOS 6 : libreoffice (CESA-2015:1458)
Updated libreoffice packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which...
Moderate: Red Hat Security Advisory: libreoffice security, bug fix, and enhancement update
Updated libreoffice packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which...
Google Chrome XSSAuditor Policy ByPass
A policy bypass vulnerability exists in Google Chrome. The vulnerability is due to improper handling of script tags within svg tags. A remote attacker can exploit this vulnerability by enticing a user to follow a crafted URL. Successful exploitation will result in bypassing the XSSAuditor feature...
DigitalSellz: The email updates issues
The email message content at the https://www.digitalsellz.com/user//email-updates page contrary to the email customization one is not validated properly. So this form allows all the html tags and their parameters. For example, all the following tags are sent as is: Link Link alert3 and all their...
WordPress Yoast Google Analytics Cross Site Scripting
OVERVIEW ========== Google Analytics by Yoast is one of the most popular WordPress plug-ins with over 7 million downloads and "1+ million" active installs. Last month Yoast patched a stored XSS we reported in the plug-in. Shortly after this we identified another bug of a similar severity. The...
Shopify: XSS on ecommerce.shopify.com
Hello! I would like to report about XSS on ecommerce.shopify.com domain. Here is a PoC that gives You alert box with "123" content: https://ecommerce.shopify.com/grader?url=imdb.jurgens.lv This Ecommerce Store Grader Tool gives You a list of sources of image tags that should have "alt" attribute ...
kernel: isofs: unbound recursion when processing relocated directories
It was found that the parserockridgeinodeinternal function of the Linux kernel's ISOFS implementation did not correctly check relocated directories when processing Rock Ridge child link CL tags. An attacker with physical access to the system could use a specially crafted ISO image to crash the...
kernel: isofs: unbound recursion when processing relocated directories
It was found that the parserockridgeinodeinternal function of the Linux kernel's ISOFS implementation did not correctly check relocated directories when processing Rock Ridge child link CL tags. An attacker with physical access to the system could use a specially crafted ISO image to crash the...
