CVE-2017-7627

The CVE-2017-7627 issue concerns the Joomla! extension “Smart related articles” (version 1.1). The root cause is a missing _JEXEC check in dialog.php, which permits direct requests bypassing proper initialization. Affected software is the Smart related articles extension for Joomla!, exposing a p...

CVE-2017-7626: Improper Neutralization of Input During Web Page Generation

The "Smart related articles" extension 1.1 for Joomla! has XSS in dialog.php nart,type in GET Method...

CVE-2017-7627: Undefined Security Weakness

The "Smart related articles" extension 1.1 for Joomla! does not prevent direct requests to dialog.php there is a missing JEXEC check...

CVE-2017-7628: Improper Neutralization of Special Elements used in an SQL Command

The "Smart related articles" extension 1.1 for Joomla! has SQL injection in dialog.php attacker must use searchcats variable in POST method to exploit this vulnerability...

Symphony Cross-Site Scripting Vulnerability

Symphony is a content management system CMS developed using PHP and MySQL. The system supports search engine optimization, module extensions and more. A cross-site scripting vulnerability exists in the publish/articles/new/ URI in Symphony version 2.6.11. A remote attacker can exploit this...

Apple Releases Multiple Security Updates

Apple has released security updates for several products to address multiple vulnerabilities. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the following Apple Support Articles...

Smart related articles ,1.1,SQL Injection and XSS

Smart related articles by Iacopo Guarneri, 1.1,SQL Injection and XSS...

Easy Support Tools 1.0 SQL Injection

Exploit Title: Easy Support Tools - FAQs, Help Articles, Blog and Feedback Script v1.0 - SQL Injection Google Dork: N/A Date: 07.02.2017 Vendor Homepage: http://nelliwinne.net/ Software Buy: https://codecanyon.net/item/easy-support-tools-faqs-help-articles-blog-and-feedback/17864522 Demo:...

WordPress REST API content injection vulnerability

1.漏洞信息： WordPress是一个以PHP和MySQL为平台的自由开源的博客软件和内容管理系统。在4.7.0版本后，REST API插件的功能被集成到WordPress中,由此也引发了一些安全性问题。近日，一个由REST API引起的影响WorePress4.7.0和4.7.1版本的漏洞被披露，该漏洞可以导致WordPress所有文章内容可以未经验证被查看，修改，删除，甚至创建新的文章，危害巨大。 2.漏洞影响版本： WordPress 4.7.0 WordPress 4.7.1 3.复现环境: Apache2.4 PHP 7.0 WordPress 4.7.1 4.复现过程:...

Home of Viral Images_ Videos and Articles Script - SQL Injection

Vulnerability: SQL Injection Date: 19.01.2017 Vendor Homepage: http://www.scriptfolder.com/ Script Name: Home of Viral Images, Videos and Articles Script Script Buy Now: http://www.scriptfolder.com/viralzone-home-of-viral-images-videos-and-articles/ Author: Ihsan Sencan Author Web: http://ihsan.n...

Five Ways That Good Guys Share More Than Bad Guys

It takes a lot for me to write a cybersecurity blog post these days. I spend most of my writing time working on my PhD. Articles like Nothing Brings Banks Together Like A Good Hack drive me up the wall, however, and a Tweet rant is insufficient. What fired me up, you might ask? Please read the...

Zarafe CMS 1.0 Cross Site Scripting

Exploit Title : Zarafe CMS 1.0 / Cross Site Scripting Exploit Author : Persian Hack Team Vendor Homepage : http://www.zarrafeh.net/ Category: Webapps Tested on: Win Version: 1.0 Date: 2016/08/27 PoC: GET = /productview.php?productid=XSS GET = /articles.php?articleid=XSS Payload : 7b084"Only For...

MS16-072: Description of the security update for Group Policy: June 14, 2016

None None...

german articles - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application german articles published at the 'play' market has multiple vulnerabilities...

Spider random articles before 1.5.3

Spider random articles versions before 1.5.3 Resolution: update to 1.5.3 Update notice: https://web-dorado.com/products/joomla-random.html...

Zendesk: Stored XSS in Draft Articles.

See title...

Internet Systems Consortium (ISC) Releases Security Updates for BIND

ISC has released security updates to address vulnerabilities in BIND. Exploitation of these vulnerabilities may allow a remote attacker to cause a denial-of-service condition. Available updates include: BIND 9 version 9.9.8 BIND 9 version 9.10.3 BIND 9 version 9.9.8-S1 Users and administrators ar...

WordPress plugin Embed-Articles/wp-admin/admin.php cross-site request forgery vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress plugin Embed-Articles/wp-admin/admin.php, which allows a...

WordPress Embed Articles Plugin <= 7.0.3 - Multiple Vulnerabilities

This plugin is prone to a cross site scripting and cross site request forgery vulnerabilities. Attackers can insert arbitrary script into admin page, hijack admin's cookies etc. Solution This plugin is closed...

WordPress Embed Articles Plugin <= 7.0.3 - Multiple Vulnerabilities

This plugin is prone to a cross site scripting and cross site request forgery vulnerabilities. Attackers can insert arbitrary script into admin page, hijack admin's cookies etc. Solution This plugin is closed...