CVE-2016-1180

The CVE-2016-1180 issue concerns the Cyber-Will EC-CUBE Social-button Premium plugin. A cross-site scripting (XSS) vulnerability exists in the Social-button Premium plugin before version 1.1 for EC-CUBE 2.13.x, allowing remote attackers to inject arbitrary web script or HTML via unspecified vecto...

EC-CUBE plugin "Social-button Plugin Premium" and "Social-button Plugin" vulnerable to cross-site scripting

Overview EC-CUBE plugin "Social-button Plugin Premium" and "Social-button Plugin" provided by Cyber-Will Inc. contain a cross-site scripting vulnerability CWE-79. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

JVN#78482127: EC-CUBE plugin "Social-button Plugin Premium" and "Social-button Plugin" vulnerable to cross-site scripting

EC-CUBE plugin "Social-button Plugin Premium" and "Social-button Plugin" provided by Cyber-Will Inc. contain a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to th...

The Fart Button - WebView JavaScript enabled, WebView files access vulnerabilities

HackApp vulnerability scanner discovered that application The Fart Button published at the 'play' market has multiple vulnerabilities...

Instant Button Mundo Canibal 2 - Dynamic Code Loading, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Instant Button Mundo Canibal 2 published at the 'play' market has multiple vulnerabilities...

Virtual Volume Button - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Virtual Volume Button published at the 'play' market has multiple vulnerabilities...

Big Fart Button - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Big Fart Button published at the 'play' market has multiple vulnerabilities...

Drupal Core Forms Interface Ignores Submit Button Access Restriction Vulnerability

Drupal is a free and open source content management system developed in PHP. An access bypass vulnerability exists in Drupal Core. Allowing input submission, e.g. using JavaScript, of form button elements that the user should not have access to because the buttons are blocked by server-side form...

WordPress Claptastic clap! Button Plugin <= 1.3 - Cross Site Scripting (XSS)

This plugin is prone to a cross site scripting vulnerability, because it fails to sufficiently sanitize user-supplied input. Solution Update the plugin...

WordPress Claptastic clap! Button Plugin <= 1.3 - Cross Site Scripting (XSS)

This plugin is prone to a cross site scripting vulnerability, because it fails to sufficiently sanitize user-supplied input. Solution Update the plugin...

Claptastic clap! Button <= 1.3 - Authenticated Cross-Site Scripting (XSS)

The claptastic-clap-button WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

WordPress Claptastic Clap! Button 1.3 Cross Site Scripting

Product: Claptastic clap! Button Exploit Author: Sachin Wagh Version: 1.3 Home page Link: https://wordpress.org/plugins/claptastic-clap-button/ ============================================================================ Details: The Claptastic clap! Button plugin for WordPress is prone to a...

Uber: Session retention is present which reveals the customer info

Issue : Session retention is present at partner.uber.com which reveals all senstive data Steps to reproduce : 1Login to partner.uber.com under any driver profile 2navigate to summary page or any page e.g payment page 3logout the application 4press back button of the application application reveal...

Adobe Flash - SimpleButton Creation Type Confusion

Adobe Flash - SimpleButton Creation Type Confusion Source: https://code.google.com/p/google-security-research/issues/detail?id=640 There is a type confusion vulnerability in the SimpleButton constructor. Flash stores an empty button to use to create buttons for optimization reasons. If this objec...

WordPress Booking Calendar Contact Form 1.0.23 Blind SQL Injection

Exploit Title: Wordpress booking calendar contact form =v1.0.23 - Unauthenticated blind SQL injection Date: 2016-02-08 Google Dork: Index of /wp-content/plugins/booking-calendar-contact-form Exploit Author: Joaquin Ramirez Martinez i0 SEC-LABORATORY Vendor Homepage: http://wordpress.dwbooster.com...

WordPress Plugin Booking Calendar Contact Form 1.0.23 - Multiple Vulnerabilities

WordPress Plugin Booking Calendar Contact Form 1.0.23 - Multiple Vulnerabilities Exploit Title: Wordpress booking calendar contact form =v1.0.23 - Unauthenticated blind SQL injection Date: 2016-02-08 Google Dork: Index of /wp-content/plugins/booking-calendar-contact-form Exploit Author: Joaquin...

Getdpd Cross Site Scripting

Document Title: =============== Getdpd Bug Bounty 1 - asm0option0 Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1464 ID: 14770 Release Date: ============= 2016-02-02 Vulnerability Laboratory ID VL-ID:...

UBUNTU-CVE-2016-1728

The Cascading Style Sheets CSS implementation in Apple iOS before 9.2.1 and Safari before 9.0.3 mishandles the "a:visited button" selector during height processing, which makes it easier for remote attackers to obtain sensitive browser-history information via a crafted web site...

Google Chrome URL Forgery Vulnerability

Google Chrome is a web browser developed by the American company Google Google. A security vulnerability exists in the 'CustomButton::AcceleratorPressed' function in the ui/views/controls/button/custombutton.cc file in Google Chrome versions prior to 48.0.2564.82. ' function in the...

chromium-browser: various fixes from internal audits

The CustomButton::AcceleratorPressed function in ui/views/controls/button/custombutton.cc in Google Chrome before 48.0.2564.82 allows remote attackers to spoof URLs via vectors involving an unfocused custom button...