811 matches found
WordPress yURL ReTwitt WP 1.4 CSRF / XSS
Title: CSRF/XSS Vulnerability in yURL ReTwitt WP Plugin Author: Manideep K CVE-ID: CVE-2014-9341 Plugin Homepage: https://wordpress.org/plugins/yurl-retwitt/ Version Affected: 1.4 probably lower versions Severity: High About Plugin: This plugin will allow your readers to publish a RT Re-Twitt on...
WP Comment Twit <= 0.5 - Multiple CSRF
Plugin is still affected and has been closed...
WP Popup <= 1.3 - XSS & CSRF
It is unclear if the issues have been fixed. Plugin has been closed...
Simple Visitor Stat <= 1.0 - Multiple XSS
Plugin is still affected and has been closed...
WordPress TwitterDash Plugin <= 2.1 - CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution This plugin is closed...
WordPress O2Tweet Plugin <= 0.0.4 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution This plugin is closed...
WordPress Bird Feeder Plugin <= 1.2.3 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution This plugin is closed...
WordPress wpCommentTwit Plugin <= 0.5 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution This plugin is closed...
WordPress Eklentisi Plugin <= 2.0 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution This plugin is closed...
Microsoft Active Directory Federation Services information leakage
It's possible to access closed session...
Ajax Pagination 1.1 - wp-admin/admin-ajax.php loop Parameter Local File Inclusion
Plugin is still affected and has been closed...
Anyfont <= 2.2.3 - XSS
Plugin is still affected and has been closed...
Alteon AceDirector Half-Closed HTTP Request IP Address Revealing Vulnerabililty
No description provided by source. source: http://www.securityfocus.com/bid/3964/info Alteon ACEdirector is a hardware solution distributed by Nortel Networks. ACEdirector runs the Nortel WebOS operating system. It is possible to retrieve the real IP addresses of webservers that are managed by an...
CUUMALL 注入 5-8
简要描述： 来了个新厂商。 挖一下把。 开放+封闭源代码 封闭源代码，普通用户使用加密后的代码，付费用户使用开放的源代码，使商城更安全 对于我这种屌丝只能用免费版 就是zend后的代码。 不过还是有几个文件没zend。 就只看这几个文件了。 详细说明： 第五处 kuaiqian/receivemall.php中 $dealTime=trim$REQUEST'dealTime'; //获取实际支付金额 ///单位为分 ///比方 2 ，代表0.02元 $payAmount=trim$REQUEST'payAmount'; //获取交易手续费 ///单位为分 ///比方 2 ，代表0.02元...
CUUMALL 注入 1-4
简要描述： 来了个新厂商。 挖一下把。 开放+封闭源代码 封闭源代码，普通用户使用加密后的代码，付费用户使用开放的源代码，使商城更安全 对于我这种屌丝只能用免费版 就是zend后的代码。 不过还是有几个文件没zend。 就只看这几个文件了。 详细说明： 找了几个没zend的文件来看看 。 第一处 ali/notifyurl.php中 $alipayNotify = new AlipayNotify$aliapyconfig; $verifyresult = $alipayNotify-verifyNotify; if$verifyresult //验证成功...
WP Guestmap <= 1.8 - Multiple XSS
Plugin is still affected and has been closed...
WP Consultant <= 1.0 - XSS
Plugin is still affected and has been closed...
WP Blipbot <= 3.0.9 - XSS
Plugin is still affected and has been closed...