[SECURITY] Fedora 21 Update: drupal7-views_bulk_operations-3.3-1.fc21

This module augments Views by allowing bulk operations to be executed on the displayed rows. It does so by showing a checkbox in front of each node, and adding a select box containing operations that can be applied. Drupal Core or Rules actions can be used. This package provides the following...

[SECURITY] Fedora 22 Update: drupal7-views_bulk_operations-3.3-1.fc22

This module augments Views by allowing bulk operations to be executed on the displayed rows. It does so by showing a checkbox in front of each node, and adding a select box containing operations that can be applied. Drupal Core or Rules actions can be used. This package provides the following...

Drupal Views Bulk Operations Module Access Bypass Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Views Bulk Operations is one of the third-party modules used to change views on nodes. An access bypass vulnerability exists in the Drupal Views Bulk Operations module in version 6.x-1....

Views Bulk Operations - Moderately critical - Access Bypass - SA-CONTRIB-2015-131

The Views Bulk Operations module enables you to add bulk operations to administration views, executing actions on multiple selected rows. The module doesn't sufficiently guard user entities against unauthorized modification. If a user has access to a user account listing view with VBO enabled suc...

Shopify: XSS at Bulk editing ProductVariants

Steps to Reproduce: 1.Create a Product with Title and Description as " 2. Now goto https://blahblah.myshopify.com/admin/products/inventory 3. Select the Product created at Step 1 and Click on Edit variants and XSS will be triggered...

Shopify: XSS at Bulk editing products

after following above the steps in 67125 goto Bulk editing products: for me the url was: https://img-src-x-onerror-prompt1-24.myshopify.com/admin/bulk?resourcename=Product&edit=variants.sku%2Cvariants.price%2Cvariants.compareatprice&message=&returnto=%2Fadmin%2Fproducts&ids=1151578433 it is also...

Sunset of Section 215 Means All Eyes on USA FREEDOM Act

The sun may have set at midnight on Section 215 of the PATRIOT Act, putting a temporary halt to the NSA’s bulk collection of phone call metadata, but privacy champions and legal experts point to May 7 as the day the lights dimmed on that facet of the government’s surveillance efforts. On that...

Shopify: Bulk Discount App in myshopify.com exposes http://bulkdiscounts.shopifyapps.com vulnerable to XSS

Installing the Bulk Discount App in .myshopify.com which requires a paid basic plan makes the bulkdiscounts.shopifyapps.com vulnerable to XSS due to non sanitized input in products and collections. POC: 1. Enter a product name or a collection such as " and save it. 2. Install the Shopify...

[SECURITY] Fedora 22 Update: drupal7-ctools-1.7-1.fc22

This suite is primarily a set of APIs and tools to improve the developer experience. It also contains a module called the Page Manager whose job is to manage pages. In particular it manages panel pages, but as it grows it will be able to manage far more than just Panels. For the moment, it includ...

New Coalition Launches Fight Against Patriot Act Section 215

A broad group of civil-rights, technology and political groups from across the spectrum has developed a new initiative to advocate for the repeal of Section 215 of the USA PATRIOT Act, the part that provides the authority for the bulk collection of phone metadata and other information. The new...

Snapchat: Captcha Bypass in Snapchat's Geofilter Submission Process

Hi, Overview: Snapchat provides a form in which users can submit "Geofilters". These are filters which get applied to users snaps when they are in specific geolocations. The form https://www.snapchat.com/geofilters/submit.html allows for the submission of these "Geofilters" as an anonymous user...

Tech Companies, Privacy Advocates Call for NSA Reform

A group of technology companies, non-profits and privacy and human rights organizations have sent a letter to President Barack Obama, the director of national intelligence and a wide range of Congressional leaders, calling for an end to the bulk collection of phone metadata under Section 215 of t...

WordPress Plugin SEO by Yoast Cross-Site Request Forgery Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.WordPress SEO by Yoast is one of the search engine optimization plugins. A cross-site request forgery vulnerability...

CVE-2015-2292: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in...

CVE-2015-2293: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that...

CVE-2014-9526

Multiple cross-site scripting XSS vulnerabilities in concrete5 5.7.2.1, 5.7.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 gName parameter in singlepages/dashboard/users/groups/bulkupdate.php or 2 instanceid parameter in tools/dashboard/sitemapdragrequest.p...

Lame Duck Senate to Vote on NSA Reforming USA FREEDOM Act

The United States Senate will move to vote on the USA FREEDOM Act before the current congressional session closes at the end of the year, a move that pleases digital rights groups. In its current form, the bill would ban the bulk collection of Americans’ private records while granting the...

CAINE 6.0 "Dark Matter" - Distribution with a complete forensic environment

CAINE Computer Aided INvestigative Environment is an Italian GNU/Linux live distribution created as a project of Digital Forensics. Currently the project manager is Nanni Bassetti. CAINE offers a complete forensic environment that is organized to integrate existing software tools as software...

DEBIAN-CVE-2014-3185

Multiple buffer overflows in the commandportreadcallback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel before 3.16.2 allow physically proximate attackers to execute arbitrary code or cause a denial of service memory corruption and system crash v...

Wordpress Bulk Delete Users by Email Plugin 1.0 - CSRF

No description provided by source. Exploit Title: Bulk Delete Users by Email, Wordpress Plugin 1.0 - CSRF Google Dork: N/A Date: 05.09.2014 Exploit Author: Fikri Fadzil - [email protected] Vendor Homepage - http://www.speakdigital.co.uk/ Software Link:...