6755 matches found
WordPress Easy Media Gallery 1.3.47 Cross Site Scripting
Exploit : For Exploiting This Vulnerability Install Easy Media Gallery Plugin Then Create New Media In Media Title Input : "/alert'Exploit' Then In Media Subtitle Like Media Title Input : "/alert'Exploit1' After Creating New JavaScript Code Will Be Executed . Video Poc : http://youtu.be/5nMQUgP6n...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in ajax.php in Cerb before 7.0.4 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a saveWorkerPeek action...
CVE-2015-6545
Cross-site request forgery CSRF vulnerability in ajax.php in Cerb before 7.0.4 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a saveWorkerPeek action...
CVE-2015-6545
CVE-2015-6545: A CSRF flaw in Cerb (Webgroup Media LLC) affects the ajax.php endpoint, enabling an authenticated attacker to add an administrator account via the saveWorkerPeek action. Affected version(s): Cerb 7.0.3 and likely earlier; fixed in Cerb 7.0.4. Impact: unauthorized creation of admin ...
Internet Systems Consortium (ISC) Releases Security Updates for BIND
ISC has released security updates to address vulnerabilities in BIND. Exploitation of these vulnerabilities may allow a remote attacker to cause a denial-of-service condition. Available updates include: BIND 9 version 9.9.7-P3 BIND 9 version 9.10.2-P4 Users and administrators are encouraged to...
Google Releases Security Update for Chrome
Google has released Chrome version 45.0.2454.85 to address multiple vulnerabilities for Windows, Mac, and Linux. Exploitation of one of these vulnerabilities may allow an attacker to take control of an affected system. US-CERT encourages users and administrators to review the Chrome Releases page...
CVE-2015-6655
Cross-site request forgery CSRF vulnerability in Pligg CMS 2.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator via a request to admin/adminusers.php...
CVE-2015-6535
Cross-site scripting XSS vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators to inject arbitrary web script or HTML via the Profile name field youtubeembedname parameter...
CVE-2015-6535
Cross-site scripting XSS vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators to inject arbitrary web script or HTML via the Profile name field youtubeembedname parameter...
WordPress Role Scoper Plugin <= 1.3.64 - Cross Site Scripting
Because of this vulnerability, authenticated administrators can inject HTML or JS code. Solution Upgrade the plugin...
WordPress Social Locker Plugin <= 4.2.0 - Reflected Cross Site Scripting
Because of this vulnerability, authenticated administrators can inject HTML or JS code. Solution Update the plugin...
WordPress Multicons Plugin <= 2.1 - Cross Site Scripting (XSS)
Because of this vulnerability, authenticated administrators can store HTML or JS code in plugin configuration values. Solution Update the plugin...
CVE-2014-8987
Cross-site scripting XSS vulnerability in the "set configuration" box in the Configuration Report page admconfigreport.php in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via the configoption parameter, a different vulnerability than...
CVE-2014-8987
Cross-site scripting XSS vulnerability in the "set configuration" box in the Configuration Report page admconfigreport.php in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via the configoption parameter, a different vulnerability than...
CVE-2014-8987
Summary (from connected sources): MantisBT versions 1.2.13–1.2.17 contain a cross-site scripting (XSS) vulnerability in the Configuration Report page (adm_config_report.php), exploitable via the config_option parameter, allowing remote administrators to inject arbitrary web script or HTML. The is...
WordPress Flowplayer Plugin <= 6.0.3.3 - Stored Cross Site Scripting
Because of this vulnerability, authenticated administrators can store HTML or JS code in plugin configuration values. Solution Upgrade this plugin...
WordPress YITH Maintenance Mode Plugin <= 1.1.4 - Cross-Site Scripting
Because of this vulnerability, authenticated administrators can store HTML and JS code. Solution Update the plugin...
WordPress Visitor Maps & Who's Online Plugin <= 1.5.8.6 - XSS
Because of this vulnerability, authenticated administrators can store HTML or JS code. Solution Update the plugin...
Apple Releases Security Update for QuickTime
Apple has released a security update to address multiple vulnerabilities in QuickTime for Windows 7 and Windows Vista. Exploitation of one of these vulnerabilities may allow an attacker to take control of an affected system. Users and administrators are encouraged to review the Apple security...
