CVE-2017-2224

Cross-site scripting vulnerability in Event Calendar WD prior to version 1.0.94 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting vulnerability in Event Calendar WD prior to version 1.0.94 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-2224

The CVE-2017-2224 vulnerability affects the WordPress plugin Event Calendar WD (Web-Dorado). It is a cross-site scripting (XSS) flaw in versions prior to 1.0.94 (notably

CVE-2017-2224

Cross-site scripting vulnerability in Event Calendar WD prior to version 1.0.94 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-2224: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in Event Calendar WD prior to version 1.0.94 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2017-15273

Name of the Vulnerable Software and Affected Versions Event Calendar WD versions prior to 1.0.94 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For versions prior to 1.0.94, update to version 1.0.94 or later to resolve the...

WordPress Event Calendar WD Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Event Calendar WD is one of the calendar plugin. A cross-site scripting vulnerability exists in versions of the...

JVN#73550134: WordPress plugin "Event Calendar WD" vulnerable to cross-site scripting

The WordPress plugin "Event Calendar WD" provided by Web-Dorado contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the logged in user's web browser. Solution Update the plugin Update the plugin according to the information provided by the developer...

Photo Gallery by WD <= 1.3.42 - Authenticated Path Traversal

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin was affected by an Authenticated Path Traversal security vulnerability...

Event Calendar WD <= 1.0.93 - Authenticated Cross-Site Scripting (XSS)

The Event Calendar WD – Responsive Event Calendar plugin WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

Authentication flaw

The Toshiba FlashAir SD-WD/WC series Class 6 model with firmware version 1.00.04 and later, FlashAir SD-WD/WC series Class 10 model W-02 with firmware version 2.00.02 and later, FlashAir SD-WE series Class 10 model W-03, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir II...

CVE-2017-2161

FlashAirTM SDHC Memory Card SD-WE Series V3.00.02 and earlier and FlashAirTM SDHC Memory Card SD-WD/WC Series V2.00.04 and earlier allows authenticated attackers to bypass access restrictions to obtain unauthorized image data via unspecified vectors...

CVE-2016-4863

CVE-2016-4863 concerns Toshiba FlashAir cards (SD-WD/WC class 6; SD-WD/WC class 10 W-02; WE-class W-03; FlashAir II/III W-02/W-03 series) where enabling Internet pass-thru Mode allows authenticationless connections from the STA LAN. The root cause is that the device does not require authenticatio...

CVE-2017-2161: Direct Request

FlashAirTM SDHC Memory Card SD-WE Series V3.00.02 and earlier and FlashAirTM SDHC Memory Card SD-WD/WC Series V2.00.04 and earlier allows authenticated attackers to bypass access restrictions to obtain unauthorized image data via unspecified vectors...

Command Execution Vulnerability in Apple CMS wd Parameter

Apple CMS program is a fast website building system that runs on PHP+MYSQL environment. A command execution vulnerability exists in the wd parameter of the search box of Apple CMS. The vulnerability stems from the failure of the wd parameter to adequately filter user-supplied input, which allows ...

Photo Gallery by WD <= 1.3.35 - Authenticated SQL Injection

http://www.defensecode.com/advisories/DC-2017-02-011WordPressWebDoradoGalleryPluginAdvisory.pdf http://www.vulnerablesite.com/wp-admin/admin-ajax.php?action=addAlbumsGalleries&albumid=0%20AND%20SELECT%20%20FROM%20SELECTSLEEP5VvZV&width=700&height=550&bwgitemsperpage=20&bwgnonce=b939983df9&TBifram...

Calendar by WD <= 1.5.51 - Authenticated SQL injection

http://www.defensecode.com/advisories/DC-2017-01-017WordPressSpiderEventCalendarPluginAdvisory.pdf Vulnerable POST URL: http://www.vulnerablesite.com/wpadmin/admin.php?page=SpiderCalendar&task=showmanageevent&calendarid=1 Vulnerable POST Body:...

Western Digital My Cloud Command Injection / File Upload Vulnerabilities

Exploit for hardware platform in category web applications title: Unauthenticated OS command injection & arbitrary file upload product: Western Digital My Cloud vulnerable version: at least: 2.21.126 My Cloud, 2.11.157My Cloud EX2, 2.21.126 My Cloud EX2 Ultra, 2.11.157 My Cloud EX4, 2.21.126 My...

WD My Cloud Mirror 2.11.153 Remote Command Execution / Authentication Bypass

Exploit Title: WD My Cloud Mirror 2.11.153 RCE and Authentication Bypass Date: 24.01.2017 Software Link: https://www.wdc.com Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/ Category: local 1. Description Itas possible to execute arbitra...

WD My Cloud Mirror 2.11.153 RCE and Authentication Bypass Vulnerabilities

Exploit for hardware platform in category web applications Exploit Title: WD My Cloud Mirror 2.11.153 RCE and Authentication Bypass Date: 24.01.2017 Software Link: https://www.wdc.com Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/...