WordPress Good News Themes - Cross Site Scripting

Because of this vulnerability in the "s" value of the "Good News themes" module, remote attackers can inject client-side script code to the vulnerable index GET method request. Also, the "s" value is wrong encoded and not filtered by the regular validation. Solution Update the theme...

WP Good News Themes - CS Cross Site Web Vulnerability

Document Title: =============== WP Good News Themes - CS Cross Site Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1771 Release Date: ============= 2016-02-28 Vulnerability Laboratory ID VL-ID: ==================================== 1771...

ElegantThemes - Privilege Escalation

Description An information disclosure vulnerability was found in the Divi Builder included in our Divi and Extra themes, as well as our Divi Builder plugin which resulted in the potential for user privilege escalation. If properly exploited, it could allow registered users, regardless of role, on...

WordPress Elegant Themes <= 2.6.3 - Privilege Escalation

WordPress Elegant Themes' products, such as Divi Builder, Divi, Extra and Divi 2.3, are prone to a privilege escalation vulnerability. Solution Update the theme...

Lightweight themes on Firefox for Android do not verify a secure connection — Mozilla

Mozilla developer Margaret Leibovic reported when Firefox for Android installs lightweight themes, it does not check to verify that they are served over an HTTPS connection. Instead, themes can be installed over an unencrypted connection, which could allow for a man-in-the-middle MITM attack by...

How do I Customize Unified Gateway Portal?

Use Case Portal is the first interaction point for end users and hence important to have correct representation of an organization. Customize the look and feel, color, logo and labels on the Gateway portal to brand the portal as per organizational standards. Introduction to Portal Customization...

Shopify: [CSRF] Install premium themes

Hi , I have found a CSRF issue in themes.shopify.com when installing premium themes. Details: When going to a premium theme page for example: https://themes.shopify.com/themes/editions/styles/light/ there is a button saying Preview in your store , clicking that button sends a POST request to...

CVE-2015-0856

daemon/Greeter.cpp in sddm before 0.13.0 does not properly disable the KDE crash handler, which allows local users to gain privileges by crashing a greeter when using certain themes, as demonstrated by the plasma-workspace breeze theme...

CVE-2015-0856

daemon/Greeter.cpp in sddm before 0.13.0 does not properly disable the KDE crash handler, which allows local users to gain privileges by crashing a greeter when using certain themes, as demonstrated by the plasma-workspace breeze theme...

Drupal MAYO theme cross-site scripting vulnerability

Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.MAYO theme is one of the modules that provides users with an easy way to define and create a theme of their choice. A cross-site scripting vulnerability exists in Drupal MAYO theme...

CVE-2015-8233

Cross-site scripting XSS vulnerability in the MAYO theme 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.6 for Drupal allows remote administrators with the "Administer themes" permission to inject arbitrary web script or HTML via unspecified vectors related to theme settings...

CVE-2015-8233

The MAYO Drupal theme (7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.6) is affected by an XSS vulnerability. Root cause: insufficient sanitization in theme settings that remote administrators with the Administer themes permission can exploit to inject arbitrary script/HTML. Impact: potential fo...

CVE-2015-8233

Cross-site scripting XSS vulnerability in the MAYO theme 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.6 for Drupal allows remote administrators with the "Administer themes" permission to inject arbitrary web script or HTML via unspecified vectors related to theme settings...

PT-2015-7753

Name of the Vulnerable Software and Affected Versions MAYO theme versions 7.x-1.x before 7.x-1.4 MAYO theme versions 7.x-2.x before 7.x-2.6 Description A cross-site scripting XSS issue exists, allowing remote administrators with the "Administer themes" permission to inject arbitrary web script or...

http-drupal-enum NSE Script

Enumerates the installed Drupal modules/themes by using a list of known modules and themes. The script works by iterating over module/theme names and requesting MODULEPATH/MODULENAME/LICENSE.txt for modules and THEMEPATH/THEMENAME/LICENSE.txt. MODULEPATH/THEMEPATH which is either provided by the...

Multiple Themes - Privilige Escalation

The themes suffer from a privilege escalation vulnerability, any authenticated user can trigger this vulnerability due to weak permissions checking. An attacker can update options, such as changing user's default role, registration state and others, which may lead to executing commands/code on th...

AnimaGallery 2.6 - Local File Inclusion

Exploit Title: AnimaGallery 2.6 theme and lang cookie parametre Local File Include Vulnerability Date: 2015/06/07 Vendor Homepage: http://dg.no.sapo.pt/ Software Link:http://dg.no.sapo.pt/AnimaGallery2.6.zip Version: 2.6 Tested on: Centos 6.5,php 5.3.2,magicquotesgpc=off Category: webapps...

Multiple WordPress ThemeMakers Themes Remote Information Disclosure Vulnerabilities

WordPress is a blogging platform developed using the PHP language that allows users to set up their weblogs on servers that support PHP and MySQL databases. Multiple WordPress ThemeMakers Themes have a remote information disclosure vulnerability. Allows attackers to exploit the vulnerability to...

PT-2015-3529

Name of the Vulnerable Software and Affected Versions Template CMS versions 2.1.1 and earlier Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the themes editor parameter in an "add template" action to "admin/index.php". Recommendations F...

PT-2015-3530

Name of the Vulnerable Software and Affected Versions Template CMS versions 2.1.1 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests. This can be done in two ways: 1 by creating an administrator user via an "add" action to...