CVE-2014-2068

The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump...

Drupal HTTP Parameter Key/Value SQL Injection

This module exploits the Drupal HTTP Parameter Key/Value SQL Injection aka Drupageddon in order to achieve a remote shell on the vulnerable instance. This module was tested against Drupal 7.0 and 7.31 was fixed in 7.32. Two methods are available to trigger the PHP payload on the target: - set...

Google Releases Security Updates for Chrome and Chrome OS

Google has released security updates to address multiple vulnerabilities in Chrome and Chrome OS, one of which could potentially allow an attacker to take control of the affected system. Updates available include: Chrome 38.0.2125.104 for Windows, Mac and Linux Chrome OS 38.0.2125.108 for all...

jenkins: information leak via system diagnostic functionalities (SECURITY-73)

The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump...

Adobe Releases Security Updates for ColdFusion and Flash Player

Adobe has released security updates to address multiple vulnerabilities in ColdFusion and Flash Player. Exploitation could allow attackers to take control of a vulnerable system. Users and administrators are encouraged to review Adobe Security Bulletins APSB 14-23 and APSB 14-22 and apply the...

Common SQL Server 2 0 0 0 vulnerability and its associated use-vulnerability warning-the black bar safety net

A, empty or weak password Beginners in the SQL Server installation in order to save, the SQL Server Administrator sa is empty or weak password, so the danger is very great, and these dangerous often beginners are not aware of, the little King feel that their library is test data, nothing with, ev...

F5 Networks BIG-IP : iControl vulnerability (K15220)

The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 11.0.0 through 11.3.0, Enterprise Manager...

Twiki Perl Code Execution

This is an advisory for TWiki administrators: The debugenableplugins request parameter allows arbitrary Perl code execution. TWiki http://twiki.org is an Open Source Enterprise Wiki and Web Application Platform used by millions of people. Vulnerable Software Version Attack Vectors Impact Severity...

Twiki Perl 4.x, 5.x, 6.x Upload Bypass / Code Execution Vulnerabilities

The debugenableplugins request parameter in Twiki versions 4.x, 5.x, and 6.0.0 allows arbitrary Perl code execution and suffer from a file upload bypass vulnerability. This is an advisory for TWiki administrators: The debugenableplugins request parameter allows arbitrary Perl code execution...

Cisco Releases Security Advisory for ASA Software

Cisco has released an advisory to address multiple vulnerabilities in the Cisco Adaptive Security Appliance ASA Software that could result in a denial of service condition. Cisco has released free software updates that address these vulnerabilities. Users and administrators are encouraged to revi...

Google Releases Security Updates for Chrome and Chrome OS

Google has released security updates to address multiple vulnerabilities in Chrome and Chrome OS, some of which could potentially allow an attacker to take control of the affected system or cause a denial of service condition. Updates available include: Chrome 38.0.2125.101 for Windows, Mac and...

WordPress Pods Plugin <= 2.4 - Multiple CSRF

Because of these vulnerabilities, the attackers can hijack the authentication of administrators for requests that conduct cross-site scripting attacks via the "toggled" parameter in the pods-components page to wp-admin/admin.php, reset pod settings and data via the "podsreset" parameter in the...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in M/Monit 3.3.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that change user passwords via the fullname and password parameters to /admin/users/update...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Openfiler 2.99.1 allow remote attackers to hijack the authentication of administrators for requests that 1 shutdown or 2 reboot the server via a request to admin/systemshutdown.html...

CVE-2012-6316

Multiple cross-site scripting XSS vulnerabilities in the TP-LINK TL-WR841N router with firmware 3.13.9 Build 120201 Rel.54965n and earlier allow remote administrators to inject arbitrary web script or HTML via the 1 username or 2 pwd parameter to userRpm/NoipDdnsRpm.htm...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the TP-LINK TL-WR841N router with firmware 3.13.9 Build 120201 Rel.54965n and earlier allow remote administrators to inject arbitrary web script or HTML via the 1 username or 2 pwd parameter to userRpm/NoipDdnsRpm.htm...

Apple Releases OS X bash Update 1.0

Apple has released OS X bash Update 1.0 to address vulnerabilities found in the Bourne-again Shell bash which could allow a remote attacker to execute arbitrary shell commands. US-CERT recommends users and administrators review Apple Security Update HT6495, TA14-268A, Vulnerability Note VU252743...

CVE-2013-3089

Cross-site request forgery CSRF vulnerability in apply.cgi in Belkin N300 F7D7301v1 router allows remote attackers to hijack the authentication of administrators for requests that modify configuration...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in apply.cgi in Linksys WRT310Nv2 2.0.0.1 allows remote attackers to hijack the authentication of administrators for requests that change passwords and modify remote management ports...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in apply.cgi in Belkin N300 F7D7301v1 router allows remote attackers to hijack the authentication of administrators for requests that modify configuration...