Apache Cassandra Remote Arbitrary Code Execution Vulnerability

Apache Cassandra is an open source distributed database management system developed by Facebook for storing exceptionally large data. Cassandra's default configuration binds unauthenticated JMX/RMI interfaces to all network interfaces. Since RMI is the API for transporting and remotely executing...

All in One SEO Pack information management vulnerability

Overview All in One SEO Pack is a WordPress plugin. All in One SEO Pack automatically adds a meta tag "Meta Description" to a page using some part of its contents, and this behavior is enabled in the initial configuration. Meta Description can be added even when a page is password-protected,...

WordPress WP All Import Plugin <= 3.2.4 - Multiple Vulnerabilities

This plugin is prone to an SQL injection and cross site scripting vulnerabilities. Because of them, attackers can gain admin access to your website or trick you into visiting the malicious URL. Solution Update the plugin...

WP All Import Pro <= 4.1.1 - Multiple Vulnerabilities

Multiple issues were fixed, such as Authenticated SQL Injection, Authenticated Reflected XSS and Unauthorised access to some methods...

WordPress Plugin All In One WP Security & Firewall SQL Injection Vulnerability

WordPress is a use of PHP language development of blogging platform , users can support PHP and MySQL database server to set up their own weblog . All In One WP Security & Firewall plugin is a Wordpress security management and firewall plugin . A SQL injection vulnerability exists in versions of...

WordPress Pie Register 2.0.14 Cross Site Scripting

+Title: Wordpress Pie Register Plugin 2.0.14 - XSS Vulnerability +Author: TUNISIAN CYBER +Date: 09/03/2015 +Type:WebApp +Risk:High +Affected Version:All +Overview: Pie Register 2.x suffers, from an XSS vulnerability. +Proof Of Concept: PHP global $pieregdirpath; includeonce...

CVE-2015-0895

Cross-site request forgery CSRF vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 aka Not Found HTTP status codes...

CVE-2015-0894

SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-0894

CVE-2015-0894 affects the WordPress plugin All In One WP Security & Firewall and its versions prior to 3.8.8. The vulnerability is described as a SQL injection (CWE-89) that could allow a remote attacker to execute arbitrary SQL commands via unspecified vectors, potentially impacting data confide...

CVE-2015-0895

Cross-site request forgery CSRF vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 aka Not Found HTTP status codes...

CVE-2015-0895

All In One WP Security & Firewall for WordPress (versions before 3.9.0) is affected by a CSRF vulnerability that can allow an attacker, while a logged-in admin exists, to hijack the administrator’s authentication to delete 404 logs via forged requests. Root cause is CSRF in the plugin; impact inc...

Wordpress WP All Import 3.2.3 plugin RCE Vulnerability

WordPress WP All Import plugin versions 3.2.3 and below suffer from a remote shell upload vulnerability. ------------------------------------------------------------------------------ WordPress WP All Import Plugin RCE ------------------------------------------------------------------------------...

WordPress WP All 3.2.3 Shell Upload

------------------------------------------------------------------------------ WordPress WP All Import Plugin RCE ------------------------------------------------------------------------------ - Vulnerability Author: James Golovich @Pritect - Exploit Author Evex @Evex1337 - Plugin Link:...

WP All Import Pro <= 4.1.0 - RCE

WP All Import does not properly verify that a user has permission to execute functions. Coupled with an interesting method that allows arbitrary functions in specific objects to be called allows this to be leveraged in many ways...

WordPress WP All Import Plugin <= 3.2.3 - Remote Code Execution

Because of this vulnerability, remote attackers can upload arbitrary files to system or retrieve any files on the system that ends in .txt or .html. Solution Update the plugin...

Facebook Launches Free Mobile Internet Service In India

Last year, the founder of the Social Network giant highlighted the future of universal Internet access, the dream that Facebook founder Mark Zuckerberg wants to fulfill — Making Internet access available to everyone across the world just like a service as essential as of 911 in the case of an...

Extract data from pcap files: PCredz

Extract data from pcap files with PCredz This tool extracts Credit card numbers, NTLMDCE-RPC, HTTP, SQL, LDAP, etc, Kerberos AS-REQ Pre-Auth etype 23, HTTP Basic, SNMP, POP, SMTP, FTP, IMAP, etc from a pcap file or from a live interface. PCredz Features: Extract from a pcap file or from a live...

vBulletin vBSSO Single Sign-On 1.4.14 - SQL Injection

vBulletin vBSSO Single Sign-On 1.4.14 - SQL Injection Exploit Title: vBulletin vBSSO Single Sign-On – = 1.4.15 This plugin is vulnerable to SQL injection at the /vbsso/avatar.php file in the fetchUserinfo function. It requires a big UNION ALL SELECT query and commenting out the LIMIT function of...

Oracle MySQL (Windows) - FILE Privilege Abuse (Metasploit)

Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Oracle MySQL for Microsoft Windows FILE Privilege Abuse', 'Description' = %q This module takes advantage of a file privilege misconfiguration problem specifically against Windows MySQL servers. Th...