3437 matches found
Token Insert Entity - Moderately Critical - Access bypass and information disclosure - SA-CONTRIB-2015-171
This module offers a WYSIWYG button to embed rendered entities in fields using a WYSIWYG normally the body of a node. There is a vulnerability because a user that can create or edit content and has the "insert entity token" permission can insert tokens relating to e.g. an unpublished node and all...
Social Share Button <= 2.1 - Authenticated Stored Cross-Site Scripting (XSS)
Fixed in 2.1.0 but fixedin set to 2.1.1 to avoid confusion between 2.1 and 2.1.0...
WordPress Social Share Button Plugin <= 2.1 - Stored Cross Site Scripting (XSS)
Because of this vulnerability, authenticated administrators can store HTML or JS code. Solution Update the plugin...
Udemy: Reflected XSS and/or malicious redirection via JWPlayer 6 configuration modification
1 Malicious attacker by visiting course page e.g. https://www.udemy.com/overview-of-big-data-hadoop/ and intercepting browser's generated requests can find one to the following URL:...
Trello: Normal User can add new users to group
A normal user does not have privilege to add new members to a group. But adding following HTML button Payload, a Normal user can add new members to a group which he did not have privilege to perform Payload: Add Members Steps To Reproduce: 1. Login to Trello https://trello.com/login 2. Navigate t...
Imgur: Reflected Flash XSS using swfupload.swf with an epileptic reloading to bypass the button-event
Hi, This was a fun one. So I noticed you're using swfupload.swf which is hosted on the main domain, imgur.com. This swfupload.swf as some settings you can use to modify the button on the upload. You can actually insert HTML into the Flash, but the button event that you select yourself using anoth...
The vulnerability of the iOS operating system allows a hacker to replace the content of web pages.
The vulnerability of the Safari browser on the iOS operating system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to replace the content of web pages by using the “open window” button on the website...
PT-2016-1293
Name of the Vulnerable Software and Affected Versions Moodle versions 2.6.11 and earlier, 2.7.x through 2.7.9, 2.8.x through 2.8.7, 2.9.x through 2.9.1 Description The issue is related to insufficient access control in the wiki component, allowing remote authenticated users to delete arbitrary...
Here's How to Get Facebook New 'Dislike Button' to Your Profile
You may call this a misleading headline. Right? Yes, it's True. And I apologize for this. But… ...before someone else tricks you to visit any malicious link with intent to hijack your Computer or to Hack Facebook Profile, I just tricked you to visit this 'WARNING' article about Facebook Scam of t...
Here's What Facebook 'Dislike or Empathy Button' Would Look Like
A Facebook Dislike button is one of the most frequently requested features from users for years. Earlier in the last week, Facebook finally confirmed its plans to add a Dislike or Empathy to your Facebook Profile and News Feed. If you are thinking that Facebook Dislike is going to be a thumbs-dow...
Facebook to Add a 'Dislike' Button, Mark Zuckerberg Confirms
When a pet dies, or your friend's family member passed away, clicking the 'Like' button to express your sympathy doesn't feel comfortable. Here a user feels a need of something to express their sadness, disagreement, anger, or something other than 'Like': Facebook should have an empathetic...
The vulnerability of the Firefox OS operating system allows a hacker to inject arbitrary HTML code.
The vulnerability of the Gaia Search app for the Firefox OS operating system exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML code by manipulating the title and search engine field of...
Multiple Flaws Exposed in Pocket Add-on for Firefox
With providing easy accessibility, the battle is not won! Server-side Vulnerabilities have been reported by a security researcher in the popular Pocket add-on that comes attached with the Firefox browser. The security flaws could have allowed hackers to exfiltrate data from the company’s servers ...
Adobe Flash - Pointer Crash in Button Handling
Adobe Flash - Pointer Crash in Button Handling Source: https://code.google.com/p/google-security-research/issues/detail?id=399&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id The attached sample, signalsigsegv7ffff60a14299554f4dc661554237404dfe394d4c6c3e674.swf, crashes in...
Adobe Flash - Pointer Crash in Button Handling
Source: https://code.google.com/p/google-security-research/issues/detail?id=399&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id The attached sample, signalsigsegv7ffff60a14299554f4dc661554237404dfe394d4c6c3e674.swf, crashes in this manner on Linux x64: = 0x00007f693158481f:...
Debian DLA-278-2 : cacti regression update
The last update of cacti in squeeze-lts, version 0.8.7g-1+squeeze7, had two regressions that caused certain output of scripts to not be processed and caused the save button of graphs.php to not save the changes. The regressions have been fixed in 0.8.7g-1+squeeze8. NOTE: Tenable Network Security...
[SECURITY] [DLA 278-2] cacti regression update
Package : cacti Version : 0.8.7g-1+squeeze8 The last update of cacti in squeeze-lts, version 0.8.7g-1+squeeze7, had two regressions that caused certain output of scripts to not be processed and caused the save button of graphs.php to not save the changes. The regressions have been fixed in...
WhatsApp Could Offer 'Like' and 'Mark as Unread' Features Soon
The popular instant messaging app WhatsApp might adopt some features from its parent company, Facebook. The messaging giant is testing some new features that might be coming to the app soon. The features include a 'Like' button similar to that of Facebook and a 'Mark as Unread' feature for chat...
PT-2015-6581
Name of the Vulnerable Software and Affected Versions Nextend Facebook Connect plugin versions prior to 1.5.6 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the redirect to parameter in the new fb...