CentOS 7 : gtk-vnc (CESA-2017:2258)

An update for gtk-vnc is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

gtk, gvnc, gvncpulse security update

CentOS Errata and Security Advisory CESA-2017:2258 An update for gtk-vnc is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

tiendeo.com XSS vulnerability

Vulnerable URL: http://www.tiendeo.com/widget/visor1.aspx?origen=blog...

RHEL 7 : gtk-vnc (RHSA-2017:2258)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2258 advisory. The gtk-vnc packages provide a VNC viewer widget for GTK. The gtk-vnc widget is built by using co- routines, which allows the widget to be...

Bitcoin Ticker Widget - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Bitcoin Ticker Widget published at the 'play' market has multiple vulnerabilities...

Cross-Site Request Forgery(CSRF)

Wordpress is vulnerable to cross-site request forgery CSRF attacks. The attacks can be launched because wp-admin/includes/class-wp-screen.php and wp-admin/widgets.php have flaws, allowing the widget-access action requests to be hijacked by the attackers...

Mail.ru: [afisha.mail.ru] HTML-инъекция через XSS на портале виджета

Insufficient input validation in combination with vulnerabilities in partner's site led to XSS in the context of afisha.mail.ru domains. afisha.mail.ru is no currently covered by Bug Bounty program. Insufficient movie id validation in a widget allowed using double dots to load arbitrary content...

Zenbership CMS 1.0.8 SQL Injection

Document Title: =============== Zenbership 1.0.8 CMS - Multiple SQL Injection Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2073 Release Date: ============= 2017-06-09 Vulnerability Laboratory ID VL-ID:...

Zenbership 1.0.8 CMS - Multiple SQL Injection Vulnerabilities

Document Title: =============== Zenbership 1.0.8 CMS - Multiple SQL Injection Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2073 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9759 CVE-ID: ======= CVE-2017-9759 Release Date:...

CVE-2016-3066

The spice-gtk widget allows remote authenticated users to obtain information from the host clipboard...

CVE-2016-3066

The spice-gtk widget allows remote authenticated users to obtain information from the host clipboard...

CVE-2016-3066

CVE-2016-3066 affects the spice-gtk widget. The connected documents describe a vulnerability where remote authenticated users can obtain information from the host clipboard via the spice-gtk component. No specific affected versions, root cause details, or remediation are provided in the supplied ...

Insight into Installed Apps Widget

XenMobile Dashboard provides different widgets which help admins to view useful information at a glance. Other than just viewing the summary that appears in form of graphs, admins can also export the complete set of data as a CSV file to view the details. Installed Apps widget is one of the very...

Chrome Universal XSS using late widget updates (CVE-2017-5006)

VULNERABILITY DETAILS Among the things that Document::shutdown does, |view-dispose| is called: From /thirdparty/WebKit/Source/core/frame/FrameView.cpp: void FrameView::dispose ... // FIXME: Do we need to do something here for OOPI? HTMLFrameOwnerElement ownerElement = mframe-deprecatedLocalOwner;...

Rimons Twitter Widget < 1.3 - XSS

The Rimons Twitter Widget WordPress plugin was affected by a XSS security vulnerability...

CVE-2017-7719

SQL injection in the Spider Event Calendar aka spider-event-calendar plugin before 1.5.52 for WordPress is exploitable with the orderby parameter to calendarfunctions.php or widgetThemefunctions.php, related to frontend/frontendfunctions.php...

PT-2017-17905

Name of the Vulnerable Software and Affected Versions Spider Event Calendar plugin versions prior to 1.5.52 Description The issue is related to SQL injection in the Spider Event Calendar plugin for WordPress. It is exploitable through the order by parameter in files such as "calendar functions.ph...

WordPress Ad Widget <= 2.11.0 - Authenticated Local File Inclusion (LFI)

The WordPress Ad Widget WordPress plugin was affected by an Authenticated Local File Inclusion LFI security vulnerability. PoC http://www.example.com/wp-content/plugins/ad-widget/views/modal/index.php?step=php://filter/convert.base64-encode/resource=../wp-config...

WordPress Ad Widget <= 2.11.0 - Authenticated Local File Inclusion (LFI)

The WordPress Ad Widget WordPress plugin was affected by an Authenticated Local File Inclusion LFI security vulnerability. http://www.example.com/wp-content/plugins/ad-widget/views/modal/index.php?step=php://filter/convert.base64-encode/resource=../wp-config...

CVE-2016-9126

Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to...