Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the options admin page in the WP-PostViews plugin before 1.63 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the qTranslate plugin 2.5.34 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the DVS Custom Notification plugin 1.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change application settings or 2 conduct cross-site scripting XSS attacks...

CVE-2012-4921

Multiple cross-site request forgery CSRF vulnerabilities in the DVS Custom Notification plugin 1.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change application settings or 2 conduct cross-site scripting XSS attacks...

Adobe Patches AIR, Pwn2Own Bug in Flash

Adobe has released updates for both its Flash Player and AIR software, patching four critical vulnerabilities, including one that was exposed at last month’s Pwn2Own hacking competition. The Flash Player vulnerabilities carry the company’s highest severity rating, Priority 1, and could lead to...

SQL Injection

Overview johnpbloch/wordpress-core is a web software you can use to create a website or blog. Affected versions of this package are vulnerable to SQL Injection due to the linksrecentlyupdatedtime parameter. An attacker can manipulate SQL queries and potentially access or alter data without proper...

FortiADC 3.2 Cross Site Scripting

I. VULNERABILITY ------------------------- XSS Reflected vulnerabilities in OS of FortiADC v3.2 II. BACKGROUND ------------------------- Fortinet's industry-leading, Network Security Platforms deliver Next Generation Firewall NGFW security with exceptional throughput, ultra low latency, and...

CVE-2013-4240

Multiple cross-site request forgery CSRF vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 add new testimonials via the hms-testimonials-addnew page, 2 add new groups via the...

Apple Releases Security Updates for Safari

Apple released Safari 6.1.3 and Safari 7.0.3 for OS X to address multiple vulnerabilities in WebKit. Software memory corruption issues may lead to information disclosure, unexpected application termination, or arbitrary code execution. Users and administrators are encouraged to review Apple Suppo...

DEBIAN-CVE-2014-2599

The HVMOPsetmemaccess HVM control operations in Xen 4.1.x for 32-bit and 4.1.x through 4.4.x for 64-bit allow local guest administrators to cause a denial of service CPU consumption by leveraging access to certain service domains for HVM guests and a large input...

Input validation

The HVMOPsetmemaccess HVM control operations in Xen 4.1.x for 32-bit and 4.1.x through 4.4.x for 64-bit allow local guest administrators to cause a denial of service CPU consumption by leveraging access to certain service domains for HVM guests and a large input...

CVE-2014-2599

The HVMOPsetmemaccess HVM control operations in Xen 4.1.x for 32-bit and 4.1.x through 4.4.x for 64-bit allow local guest administrators to cause a denial of service CPU consumption by leveraging access to certain service domains for HVM guests and a large input...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Symphony CMS before 2.3.2 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the sort parameter to system/authors/, related to CVE-2013-2559...

CVE-2014-0126

Cross-site request forgery CSRF vulnerability in enrol/imsenterprise/importnow.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that import an IMS Enterprise file...

CVE-2013-1408

Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the 1 search or 2 orderby parameter to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote...

Malware Attacks Against Linux 2.6 Websites

The risks presented by unsupported operating systems are being called out in a large-scale attack on hundreds of websites. Hackers have hit web servers running a version of the Linux 2.6 kernel released seven years ago. The result is a multistage attack where compromised websites are spiked with...

NSA Targets Sys Admins to Access Networks

The latest set of Snowden documents reveal details on perhaps the biggest no-brainer from the National Security Agency’s point of view during these nine months of leaks: the targeting of system administrators. Classified presentations, documents and notes portray the NSA as confident and...

Google Releases Security Updates for Chrome

Google has released security updates to address multiple vulnerabilities in Chrome. Some of these vulnerabilities may lead to memory corruption or arbitrary code execution. Updates available include: Chrome 33.0.1750.154 for Windows. Chrome 33.0.1750.152 for Mac and Linux. Chrome 33.0.1750.152 fo...

OpenX 2.8.11 Cross Site Request Forgery

Hello, Multiple cross-site request forgery CSRF vulnerabilities in OpenX 2.8.11and earlier allows remote attackers to hijack the authentication of administrators for requests that delete 1 users, 2 advertisers, 3 banners, 4 campaigns, 5 channels, 6 websites or 7 zones via delete actions. File:...

CVE-2013-0297

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 sitename or 2 siteurl parameter to apps/external/ajax/setsites.php...