CVE-2014-5347

Multiple cross-site request forgery CSRF vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 disqusreplace, 2 disquspublickey, or 3...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 disqusreplace, 2 disquspublickey, or 3...

Cross site scripting

Cross-site scripting XSS vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 activate or 2 deactivate the plugin via the active parameter to wp-admin/edit-comments.php, 3...

CVE-2014-5346

Multiple cross-site request forgery CSRF vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 activate or 2 deactivate the plugin via the active parameter to wp-admin/edit-comments.php, 3...

CVE-2014-5345

Cross-site scripting XSS vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter...

CVE-2014-5345

The CVE-2014-5345 entry concerns a Cross-Site Scripting (XSS) vulnerability in the Disqus Comment System WordPress plugin’s upgrade.php, exploitable via the step parameter in versions prior to 2.76. Affected software: Disqus Comment System plugin for WordPress (pre-2.76). Root cause: improper han...

CVE-2014-5347

Disqus Comment System plugin for WordPress (versions before 2.76) is affected by CSRF vulnerabilities that can allow an attacker to hijack an administrator’s authenticated session and trigger XSS via parameters to wp-admin/edit-comments.php (disqus_replace, disqus_public_key, disqus_secret_key) o...

CVE-2014-5346

The CVE-2014-5346 entry affects the WordPress Disqus Comment System plugin version 2.77. The vulnerability is Cross-Site Request Forgery (CSRF) that allows remote attackers to hijack the authentication of administrators for requests that (1) activate or (2) deactivate the plugin via the active pa...

Comment Control 0.3.0 - comment-control.php type Parameter SQL Injection

The comment-control WordPress plugin was affected by a comment-control.php type Parameter SQL Injection security vulnerability...

Live Comment Preview 2.0.2 - Comment Field Preview XSS

The live-comment-preview WordPress plugin was affected by a Comment Field Preview XSS security vulnerability...

Comment Rating 2.9.23 - Multiple Vulnerabilities

The comment-rating WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...

WordPress Comment Control Plugin <= 0.3.0 - SQL Injection

This plugin is prone to an SQL injection vulnerability in comment-control.php type parameter. Solution Update the plugin...

Chinese Hackers Stole Blueprints of Israel's Iron Dome Missile Defense System

Chinese hackers infiltrated the databases of three Israeli defense contractors and stole plans for Israel's Iron Dome missile defense system, according to an investigation by a Maryland-based cyber security firm ‘Cyber Engineering Services Inc. CyberESI’. Not just this, the hackers were also able...

Sql injection

SQL injection vulnerability in E2 before 2.4 2845 allows remote attackers to execute arbitrary SQL commands via the note-id parameter to @actions/comment-process...

Ilya Birman E2 - '/@actions/comment-process' SQL Injection

source: https://www.securityfocus.com/bid/68843/info Ilya Birman E2 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities ...

CVE-2014-4954

Cross-site scripting XSS vulnerability in the PMAgetHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a...

CVE-2014-4954

Cross-site scripting XSS vulnerability in the PMAgetHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a...

Cross site scripting

Cross-site scripting XSS vulnerability in the PMAgetHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a...

CVE-2014-4954

Cross-site scripting XSS vulnerability in the PMAgetHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a...