tiendeo.com XSS vulnerability

Vulnerable URL: http://www.tiendeo.com/widget/visor1.aspx?origen=blog...

RHEL 7 : gtk-vnc (RHSA-2017:2258)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2258 advisory. The gtk-vnc packages provide a VNC viewer widget for GTK. The gtk-vnc widget is built by using co- routines, which allows the widget to be...

Bitcoin Ticker Widget - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Bitcoin Ticker Widget published at the 'play' market has multiple vulnerabilities...

Cross-Site Request Forgery(CSRF)

Wordpress is vulnerable to cross-site request forgery CSRF attacks. The attacks can be launched because wp-admin/includes/class-wp-screen.php and wp-admin/widgets.php have flaws, allowing the widget-access action requests to be hijacked by the attackers...

Mail.ru: [afisha.mail.ru] HTML-инъекция через XSS на портале виджета

Insufficient input validation in combination with vulnerabilities in partner's site led to XSS in the context of afisha.mail.ru domains. afisha.mail.ru is no currently covered by Bug Bounty program. Insufficient movie id validation in a widget allowed using double dots to load arbitrary content...

Zenbership CMS 1.0.8 SQL Injection

Document Title: =============== Zenbership 1.0.8 CMS - Multiple SQL Injection Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2073 Release Date: ============= 2017-06-09 Vulnerability Laboratory ID VL-ID:...

Zenbership 1.0.8 CMS - Multiple SQL Injection Vulnerabilities

Document Title: =============== Zenbership 1.0.8 CMS - Multiple SQL Injection Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2073 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9759 CVE-ID: ======= CVE-2017-9759 Release Date:...

CVE-2016-3066

The spice-gtk widget allows remote authenticated users to obtain information from the host clipboard...

CVE-2016-3066

The spice-gtk widget allows remote authenticated users to obtain information from the host clipboard...

CVE-2016-3066

CVE-2016-3066 affects the spice-gtk widget. The connected documents describe a vulnerability where remote authenticated users can obtain information from the host clipboard via the spice-gtk component. No specific affected versions, root cause details, or remediation are provided in the supplied ...

Insight into Installed Apps Widget

XenMobile Dashboard provides different widgets which help admins to view useful information at a glance. Other than just viewing the summary that appears in form of graphs, admins can also export the complete set of data as a CSV file to view the details. Installed Apps widget is one of the very...

Chrome Universal XSS using late widget updates (CVE-2017-5006)

VULNERABILITY DETAILS Among the things that Document::shutdown does, |view-dispose| is called: From /thirdparty/WebKit/Source/core/frame/FrameView.cpp: void FrameView::dispose ... // FIXME: Do we need to do something here for OOPI? HTMLFrameOwnerElement ownerElement = mframe-deprecatedLocalOwner;...

Rimons Twitter Widget < 1.3 - XSS

The Rimons Twitter Widget WordPress plugin was affected by a XSS security vulnerability...

CVE-2017-7719

SQL injection in the Spider Event Calendar aka spider-event-calendar plugin before 1.5.52 for WordPress is exploitable with the orderby parameter to calendarfunctions.php or widgetThemefunctions.php, related to frontend/frontendfunctions.php...

WordPress Ad Widget <= 2.11.0 - Authenticated Local File Inclusion (LFI)

The WordPress Ad Widget WordPress plugin was affected by an Authenticated Local File Inclusion LFI security vulnerability. http://www.example.com/wp-content/plugins/ad-widget/views/modal/index.php?step=php://filter/convert.base64-encode/resource=../wp-config...

WordPress Ad Widget <= 2.11.0 - Authenticated Local File Inclusion (LFI)

The WordPress Ad Widget WordPress plugin was affected by an Authenticated Local File Inclusion LFI security vulnerability. PoC http://www.example.com/wp-content/plugins/ad-widget/views/modal/index.php?step=php://filter/convert.base64-encode/resource=../wp-config...

CVE-2016-9126

Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to...

CVE-2016-9126

Affected software: Revive Adserver prior to 3.2.3. Issue: persistent XSS in the audit trail widget on login due to inadequate escaping of usernames; an authenticated user who can create other users could leverage this to access the administrator account. Impact (per sources): CVSS metrics show ba...

Trend Micro Control Manager Widget importFile.php Directory Traversal

A directory traversal vulnerability has been reported in Trend Micro Control Manager. This vulnerability is caused by improper sanitization of directory traversal characters by importFile php. A remote, unauthenticated attacker could exploit this vulnerability by uploading arbitrary files onto th...

HashOver Cross-Site Scripting Vulnerability

HashOver is a free and open source PHP-based commenting system. A cross-site scripting vulnerability exists in HashOver version 2.0, which stems from the program's failure to adequately filter user data submitted to the 'hashover/scripts/widget-output.php' URL. A remote attacker could exploit thi...