WordPress Pootle button plugin <=1.1.1 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability found in WordPress Pootle button plugin versions =1.1.1. Solution Update the WordPress Pootle button plugin to the latest available version at least version 1.2.0...

WordPress Pootle Button 1.1.1 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Credit Ricardo Sanchez Vulnerable Pootle button plugin 1.1.1 Pootle button plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute...

WordPress Pootle Button 1.1.1 Cross Site Scripting

Class Input Validation Error Remote Yes Reflected Yes Credit Ricardo Sanchez Vulnerable Pootle button plugin 1.1.1 Pootle button plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute...

pootle button <= 1.1.1 - Authenticated Cross-Site Scripting (XSS)

The pootle button WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability. http://example.com/wp-admin/admin-ajax.php?action=pbtndialog&assetsurl=%22%3E%3Cimg%20src=x%20onerror=alert1%3E...

Drupal Facebook Like Button Module DRUPAL-SA-CONTRIB-2017-066 Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Facebook Like Button module DRUPAL-SA-CONTRIB-2017-066 due to the program failing to properly filter user-supplie...

Facebook Like Button - Moderately Critical - XSS - DRUPAL-SA-CONTRIB-2017-066

This module provides a Facebook Like button on node pages and blocks. The module does not sufficiently sanitize output when configured to use custom css rules. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer fblikebutton". CVE...

CVE-2017-11725

The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button, leading to unintended redirections...

Code injection

The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button, leading to unintended redirections...

CVE-2017-11725

The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button, leading to unintended redirections...

CVE-2017-11725

The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button, leading to unintended redirections...

CVE-2017-11725

CVE-2017-11725 affects IBM Security Secret Server (Thycotic Secret Server) prior to 10.2.000019. The vulnerability resides in the share function where the Back Button is mishandled, causing unintended redirections (open redirect-like behavior) and potential user confusion or credential exposure r...

CVE-2017-11725: URL Redirection to Untrusted Site

The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button, leading to unintended redirections...

NetScaler SD-WAN 410-SE Stuck in Rescue Mode When Factory Reset Using NMI Button

NetScaler SD-WAN 410-SE stuck in rescue mode when it is factory reset using NMI reset button. User does not see the outputs mentioned in the reset Citrix Documentation. The following is a screenshot of recovery image landing in rescue environment: You will then see the Choose Box ID option:...

Google Silently Adds 'Panic Detection Mode" to Android 7.1 – How It's Useful

How often do you click the 'back' or the ‘Home’ button on your mobile device to exit an application immediately? I believe, several times in a single day because a large number of apps do not have an exit button to directly force-close them instead of going back and back and back until they exit...

Design/Logic Flaw

A Resource Exhaustion issue was discovered in Schneider Electric Modicon M340 PLC BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP341000, BMXP342000, BMXP3420102, BMXP3420102CL, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, and BMXP342030H. A remote attacker...

Piwigo Plugin Facetag 0.0.3 - Cross-Site Scripting

Exploit Title: Piwigo plugin Facetag , Persistent XSS Date: 31-05-2017 Extension Version: 0.0.3 Software Link: http://piwigo.org/basics/downloads Extension link : http://piwigo.org/ext/extensionview.php?eid=845 Exploit Author: Touhid M.Shaikh Contact: http://twitter.com/touhidshaikh22 Website:...

PT-2017-15230

Name of the Vulnerable Software and Affected Versions Captcha versions prior to 4.3.0 Car Rental versions prior to 1.0.5 Contact Form Multi versions prior to 1.2.1 Contact Form versions prior to 4.0.6 Contact Form to DB versions prior to 1.5.7 Custom Admin Page versions prior to 0.1.2 Custom Fiel...

Shopify: XSS in $shop$.myshopify.com/admin/ via "Button Objects" in malicious app

This report is similar in impact, exploitability and root-cause as report 205701 requiring an additional step of user-interaction. Description The Shopify Embedded App SDK is used to facilitate limited interactions with parent page /admin/apps/$id from an embedded app within the shop admin...

CVE-2016-2406: Undefined Security Weakness

The permission control module in Huawei Document Security Management aka DSM before V100R002C05SPC670 allows remote authenticated users to obtain sensitive information from encrypted documents by leveraging incorrect control of permissions on the PrintScreen button...

LocalTapiola: show control page if you insert ' at http://viestinta.lahitapiola.fi/

Issue The reporter found that one error page that could be triggered had an outer "frame" that contained some administrative menus and a logoff-button. The menus were visible but as the user was not logged on, had no real functionality enabled. The logoff-button was mereley misinforming. Fix The...