Persistent cross-site scripting (XSS) via DailyMotionRenderer

A number of renderer classes used by the widget macro were previously identified that contained URL validation flaws leading to persistent cross-site scripting XSS vulnerabilities. The modified classes now make use of the isUrlMatch method from the WidgetConnectorUtil class in the implementation ...

Persistent cross-site scripting (XSS) via DailyMotionRenderer

A number of renderer classes used by the widget macro were previously identified that contained URL validation flaws leading to persistent cross-site scripting XSS vulnerabilities. The modified classes now make use of the isUrlMatch method from the WidgetConnectorUtil class in the implementation ...

Firefox < 24.0 Multiple Vulnerabilities

The installed version of Firefox is earlier than 24.0 and is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. CVE-2013-1718, CVE-2013-1719 - The HTML5 Tree Builder do...

Firefox < 24.0 Multiple Vulnerabilities (Mac OS X)

The installed version of Firefox is earlier than 24.0 and is, therefore, potentially affected by multiple vulnerabilities : - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. CVE-2013-1718, CVE-2013-1719 - The HTML5 Tree Builder does no...

Mozilla Thunderbird 17.x through 23.x Multiple Vulnerabilities

The installed version of Thunderbird is 17.x or later but prior to 24. It is, therefore, potentially affected the following vulnerabilities: - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. CVE-2013-1718, CVE-2013-1719 - The HTML5 Tre...

SeaMonkey < 2.21 Multiple Vulnerabilities

The installed version of SeaMonkey is earlier than 2.21 and thus, is potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. CVE-2013-1718, CVE-2013-1719 - The HTML5 Tree Builder does n...

CVE-2013-1723

The NativeKey widget in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 processes key messages after destruction by a dispatched event listener, which allows remote attackers to cause a denial of service application crash by leveraging incorrect event usage after...

CVE-2013-1723

CVE-2013-1723 affects Mozilla Firefox (before 24.0), Thunderbird (before 24.0) and SeaMonkey (before 2.21). The NativeKey widget processes key messages after destruction by a dispatched event listener, enabling a denial of service (application crash) via incorrect event usage after widget-memory ...

Mozilla Thunderbird < 24.0

Binary data 8011.prm...

PT-2013-3354

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 24.0 Thunderbird versions prior to 24.0 SeaMonkey versions prior to 2.21 Description The issue is related to the NativeKey widget, which incorrectly processes key messages after its destruction by a dispatched...

WordPress Plugin IndiaNIC Testimonial - Multiple Vulnerabilities

WordPress Plugin IndiaNIC Testimonial - Multiple Vulnerabilities Details ======================== Application: Testimonial Version: 2.2 Type: Wordpress plugin Vendor: IndiaNIC Vulnerability: - XSS CWE-79 - CSRF CWE-352 - SQL Injection CWE-89 Description ======================== Testimonial Plugin...

WordPress Plugin IndiaNIC Testimonial - Multiple Vulnerabilities

Details ======================== Application: Testimonial Version: 2.2 Type: Wordpress plugin Vendor: IndiaNIC Vulnerability: - XSS CWE-79 - CSRF CWE-352 - SQL Injection CWE-89 Description ======================== Testimonial Plugin allows you to add, delete, edit and place what others said about...

CVE-2013-2209

Cross-site scripting XSS vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name...

PT-2013-3599

Name of the Vulnerable Software and Affected Versions Review Board versions 1.6.x through 1.6.16 Review Board versions 1.7.x through 1.7.9 Description A cross-site scripting XSS issue exists in the auto-complete widget, allowing remote attackers to inject arbitrary web script or HTML via a full...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Dropdown Menu Widget plugin 1.9.1 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting XSS sequences...

CVE-2013-2704

Cross-site request forgery CSRF vulnerability in the Dropdown Menu Widget plugin 1.9.1 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting XSS sequences...

CVE-2013-2704

Cross-site request forgery CSRF vulnerability in the Dropdown Menu Widget plugin 1.9.1 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting XSS sequences...

CVE-2013-2704

The CVE-2013-2704 entry concerns the WordPress plugin Dropdown Menu Widget (version 1.9.1). The vulnerability is described as a Cross-Site Request Forgery (CSRF) that allows remote attackers to hijack the authentication of arbitrary users for requests that insert Cross-Site Scripting (XSS) sequen...

PT-2013-3881

Name of the Vulnerable Software and Affected Versions Dropdown Menu Widget plugin version 1.9.1 Description The issue is a cross-site request forgery CSRF vulnerability that allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting XSS...

CVE-2013-2704: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Dropdown Menu Widget plugin 1.9.1 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting XSS sequences...