812 matches found
CVE-2015-1111
CVE-2015-1111 affects Safari on iOS prior to 8.3. The issue: clearing history does not delete data from the Recently Closed Tabs/history file, allowing an attacker to read sensitive information. Root cause: history data not fully purged during history-clearing actions. Impact: potential informati...
A Token’s Tale
Posted by James Forshaw currently impersonating NT AUTHORITY\SYSTEM. Much as I enjoy the process of vulnerability research sometimes there’s a significant disparity between the difficulty of finding a vulnerability and exploiting it. The Project Zero blog contains numerous examples of complex...
chromium-browser: use-after-free in Speech
Use-after-free vulnerability in browser/speech/ttsmessagefilter.cc in the Speech implementation in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving utterances from a closed tab...
Oracle / Sun / PeopleSoft / MySQL multiple security vulnerabilities
Over 150 vulnerabilities in different applications are closed in auqrterly update...
UBUNTU-CVE-2014-7935
Use-after-free vulnerability in browser/speech/ttsmessagefilter.cc in the Speech implementation in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving utterances from a closed tab...
WordPress Sliding Social Icons Plugin <= 1.61 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution No fix available, because the plugin has...
VNC Server (Reflective Injection), Hidden Bind Ipknock TCP Stager
Inject a VNC Dll via a reflective loader staged. Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method you can spoof it with tools like hping. After that you could get your shellcode from any IP. The socket wil...
Twimp WP <= 0.1 - Multiple CSRF
Plugin is still affected and has been closed...
Gslideshow <= 0.1 - Multiple CSRF
Plugin is still affected and has been closed...
Pictobrowser Gallery <= 0.3.1 - Multiple CSRF
Plugin is still affected and has been closed...
Tweetscribe <= 1.1 - Multiple CSRF
Plugin is still affected and has been closed...
WordPress PWG Random Plugin <= 1.11 - Multiple CSRG and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution This plugin is closed...
WordPress gSlideshow Plugin 0.1 - CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution This plugin is closed...
WordPress Wp Unique Article Header Image Plugin <= 1.0 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution There is no solution, because plugin is...
WordPress SimpleFlickr Plugin <= 3.0.3 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution This plugin is closed...
WordPress Simple Life Plugin <=1.2 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution This plugin is closed...
WordPress WP to Twitter Plugin <= 0.7 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution This plugin is closed...
Spnbabble <= 1.4.1 - Multiple CSRF
Plugin is still affected and has been closed...