Social Warfare <= 3.5.2 - Unauthenticated Arbitrary Settings Update

Malicious eval is being inserted into the wpoptions table, in the optionname: socialwafaresettings, in the Twitter field. When the plugin is active, it causes the site to issue a JavaScript redirect to porn sites. Deactivating the plugin disables the redirect, but the malicious eval is still in t...

Like Button Rating < 2.5.4 - Unauthenticated Arbitrary Blog Settings Change

In the init action, this plugin checked to see if $POST'likebtnimportconfig' is empty. If it’s not empty then it base64-decodes the string, parses it as JSON, and starts changing options. This could allow attackers to change blog settings such as the Site Title. PoC The below form will set the...

The vulnerability of the iOS operating system allows a hacker to bypass the sandbox mechanism and read arbitrary settings.

The vulnerability of the CFPreferences component in the iOS operating system is related to deficiencies in access control for certain functions. Exploiting this vulnerability allows a malicious actor to bypass sandbox mechanisms and read arbitrary settings using a specially crafted application...