CVE-2014-0173

The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to...

CVE-2014-0173: Undefined Security Weakness

The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to...

PT-2014-3516

Name of the Vulnerable Software and Affected Versions Jetpack plugin versions 1.9 through 1.9.3 Jetpack plugin versions 2.0.x through 2.0.8 Jetpack plugin versions 2.1.x through 2.1.3 Jetpack plugin versions 2.2.x through 2.2.6 Jetpack plugin versions 2.3.x through 2.3.6 Jetpack plugin versions...

WordPress Jetpack插件安全绕过漏洞

Bugtraq ID:66789 CVE ID:CVE-2014-0173 WordPress是一种使用PHP语言开发的博客平台，用户可以在支持PHP和MySQL数据库的服务器上架设自己的网志。 WordPress Jetpack插件访问XML-RPC服务时不正确校验授权，允许攻击者利用漏洞执行受限操作。 0 WordPress Jetpack Plugin 2.x WordPress Jetpack Plugin 2.9.3版本已修复该漏洞，建议用户下载使用： http://wordpress.org/plugins/jetpack/...

WordPress XML-RPC PingBack vulnerability analysis-vulnerability warning-the black bar safety net

! Screen Shot 2014-03-12 at 9.47.56 AM A recent article outlines how to use the WordPress XML-RPC pingback functionDDosattack. This article will be on the attack for analysis, while for the site administrator to provide information to protect their website. This is not a new vulnerability WordPre...

WordPress XML-RPC PingBack vulnerability analysis-vulnerability warning-the black bar safety net

This is not a new vulnerability WordPress XML-RPC API is not new launch. The following is the seven years ago wordpress bug data. ! Screen Shot 2014-03-12 at 10.15.29 AM Although the vulnerability is not the latest, but the attack code/tools is nearly two years to appear. Tools for script kiddies...

162,000 WordPress Sites Used in DDoS Attack

More than 162,000 “popular and clean” WordPress sites were recently used in a large-scale distributed denial of service attack DDoS that exploited the content management system’s pingback feature. While the WordPress team is aware of the issue it’s not expected to be patched as it’s a default...

162,000 vulnerable WordPress websites abused to perform DDoS Attack

DDoS attacks are a growing issue facing by governments and businesses. In a recent attack, thousands of legitimate WordPress websites have been hijacked by hackers, without the need for them to be compromised. Instead, the attackers took advantage of an existing WordPress vulnerability...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in systems/sdc/notes.jsp in Spacewalk and Red Hat Network RHN Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the 1 subject or 2 content values of a note in a system.addNote XML-RPC call...

CVE-2012-6149

Multiple cross-site scripting XSS vulnerabilities in systems/sdc/notes.jsp in Spacewalk and Red Hat Network RHN Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the 1 subject or 2 content values of a note in a system.addNote XML-RPC call...

CVE-2012-6149

CVE-2012-6149 describes multiple XSS vulnerabilities in Spacewalk/RHN Satellite 5.6 via notes.jsp (subject/content) that allow an authenticated or remote attacker to inject scripts in the notes system.addNote XML-RPC flow. Connected sources identify Spacewalk 5.6 as affected and describe the root...

PT-2014-2378

Name of the Vulnerable Software and Affected Versions Red Hat Network Satellite versions 5.6 Description The issue allows remote attackers to inject arbitrary web script or HTML via the subject or content values of a note in a system.addNote XML-RPC call, potentially leading to cross-site scripti...

CVE-2012-6149: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in systems/sdc/notes.jsp in Spacewalk and Red Hat Network RHN Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the 1 subject or 2 content values of a note in a system.addNote XML-RPC call...

(spacewalk-java): XSS in system.addNote XML-RPC call due improper sanitization of note's subject and content

Multiple cross-site scripting XSS vulnerabilities in systems/sdc/notes.jsp in Spacewalk and Red Hat Network RHN Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the 1 subject or 2 content values of a note in a system.addNote XML-RPC call...

CVE-2012-0059

A flaw was found in Spacewalk-backend. This information disclosure vulnerability occurs when a system registration XML-RPC call fails, causing cleartext user passwords to be included in error messages. Remote administrators can exploit this by reading server logs and emails, leading to the...

CVE-2012-0059 Spacewalk-backend: spacewalk-backend: information disclosure via cleartext passwords in error messages

A flaw was found in Spacewalk-backend. This information disclosure vulnerability occurs when a system registration XML-RPC call fails, causing cleartext user passwords to be included in error messages. Remote administrators can exploit this by reading server logs and emails, leading to the...

CVE-2012-0059

CVE-2012-0059 affects the Spacewalk-backend in Red Hat Network Satellite and Proxy 5.4. A vulnerability in the system-registration XML-RPC error handling causes cleartext RHN user passwords to be included in error messages, exposing credentials via server logs and automated emails. This disclosur...

CVE-2012-0059

A flaw was found in Spacewalk-backend. This information disclosure vulnerability occurs when a system registration XML-RPC call fails, causing cleartext user passwords to be included in error messages. Remote administrators can exploit this by reading server logs and emails, leading to the...

PT-2014-2202

Name of the Vulnerable Software and Affected Versions Red Hat Network RHN Satellite and Proxy version 5.4 Description The issue allows remote administrators to obtain user passwords by reading the server log and an email when a system registration XML-RPC call fails. This occurs because cleartext...

CVE-2012-0059: Generation of Error Message Containing Sensitive Information

A flaw was found in Spacewalk-backend. This information disclosure vulnerability occurs when a system registration XML-RPC call fails, causing cleartext user passwords to be included in error messages. Remote administrators can exploit this by reading server logs and emails, leading to the...