CVE-2014-3756

The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service hang and resource consumption via a crafted string that is treated as rich-text by a Qt widget, as demonstrated by the 1 user or 2 channel name in a Qt dialog, 3...

CVE-2014-3756

The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service hang and resource consumption via a crafted string that is treated as rich-text by a Qt widget, as demonstrated by the 1 user or 2 channel name in a Qt dialog, 3...

CVE-2014-3756

The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service hang and resource consumption via a crafted string that is treated as rich-text by a Qt widget, as demonstrated by the 1 user or 2 channel name in a Qt dialog, 3...

ThinkSNS第二弹 － SQL注入

简要描述： ThinkSNS漏洞系列第二弹，某处处理不当导致SQL注入 详细说明： 漏洞点出现在Comment Widget里： \addons\widget\CommentWidget\CommentWidget.class.php:138 / 添加评论的操作 @return array 评论添加状态和提示信息 / public function addcomment // 返回结果集默认值 $return = array 'status' = 0, 'data' = L 'PUBLICCONCENTISERROR' ; // 获取接收数据 $data = $POST; // 安全过滤...

ThinkSNS第一弹 － SQL注入

简要描述： ThinkSNS漏洞系列第一弹，某处处理不当导致SQL注入 详细说明： 漏洞点出现在Comment Widget里： \addons\widget\CommentWidget\CommentWidget.class.php:138 / 添加评论的操作 @return array 评论添加状态和提示信息 / public function addcomment // 返回结果集默认值 $return = array 'status' = 0, 'data' = L 'PUBLICCONCENTISERROR' ; // 获取接收数据 $data = $POST; // 安全过滤...

CVE-2014-7501

The Translation Widget aka com.wTranslationGadget application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Translation Widget aka com.wTranslationGadget application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7501

The Translation Widget (com.wTranslationGadget) for Android, version 0.1, does not verify X.509 certificates from SSL servers, enabling MITM attacks to spoof servers and obtain sensitive information via a crafted certificate. According to the CVE-2014-7501 entry, the impact includes partial confi...

CVE-2014-7049

The CVE-2014-7049 entry concerns the SomTodo (com.somcloud.somtodo) Android app version 2.0.3, which does not verify X.509 certificates from SSL servers. This trust weakness allows a man-in-the-middle to spoof servers and obtain sensitive information via a crafted certificate. The vulnerability a...

CVE-2014-6312

Cross-site request forgery CSRF vulnerability in the Login Widget With Shortcode login-sidebar-widget plugin before 3.2.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the customstyleafo paramete...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Login Widget With Shortcode login-sidebar-widget plugin before 3.2.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the customstyleafo paramete...

CVE-2014-6312

CVE-2014-6312: A CSRF vulnerability in the WordPress plugin Login Widget With Shortcode (login-sidebar-widget) prior to version 3.2.1 allows remote attackers to hijack administrator sessions and perform XSS via the custom_style_afo parameter on the login_widget_afo page leading to wp-admin/option...

CVE-2014-6312

Cross-site request forgery CSRF vulnerability in the Login Widget With Shortcode login-sidebar-widget plugin before 3.2.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the customstyleafo paramete...

chromium: multiple security fixes in Chrome 38.0.2125.101

Use-after-free vulnerability in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers a widget-position update that improperly interacts with the render tree,...

Design/Logic Flaw

Use-after-free vulnerability in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers a widget-position update that improperly interacts with the render tree,...

UBUNTU-CVE-2014-3191

Use-after-free vulnerability in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers a widget-position update that improperly interacts with the render tree,...

PYSEC-2014-46

Cross-site scripting XSS vulnerability in widgettraversal.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

[SECURITY] Fedora 20 Update: baloo-widgets-4.14.1-1.fc20

Widgets for Baloo...

WordPress Login Widget With Shortcode Plugin 3.1.1 - Multiple Vulnerabilities

Login Widget With Shortcode plugin is prone to CSRF and XSS vulnerabilities that allow an attacker to insert arbitrary HTML into an admin page. Then an attacker can use Javascript to control an admin user’s browser and create user accounts, posts, etc. Solution Update the plugin...

WordPress Plugin Login Widget With ShortCode 3.1.1 - Multiple Vulnerabilities

Details ================ Software: Login Widget With Shortcode Version: 3.1.1 Homepage: http://wordpress.org/plugins/login-sidebar-widget/ Advisory report:...