WordPress Conversion Ninja Cross Site Scripting

++++++++++++++++++++++++ + + Exploit Title: Wordpress Plugin Conversionninja Cross Site Scripting + + Exploit Author: Ashiyane Digital Security Team + + Date: 2014-05-22 + + Google Dork : inurl:wp-content/plugins/conversionninja + + Vendor Homepage : http://www.Wordpress.org + + Tested on: Window...

Debian DSA-2934-1 : python-django - security update

Several vulnerabilities were discovered in Django, a high-level Python web development framework. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2014-0472 Benjamin Bach discovered that Django incorrectly handled dotted Python paths when using the revers...

[SECURITY] [DSA 2934-1] python-django security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2934-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso May 19, 2014 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 2934-1 (python-django - security update)

Several vulnerabilities were discovered in Django, a high-level Python web development framework. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2014-0472 Benjamin Bach discovered that Django incorrectly handled dotted Python paths when using the reverse U...

DSA-2934-1 python-django - security update

Bulletin has no description...

CVE-2014-0474

The 1 FilePathField, 2 GenericIPAddressField, and 3 IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, relate...

PYSEC-2014-3

The 1 FilePathField, 2 GenericIPAddressField, and 3 IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, relate...

CVE-2014-0474

The 1 FilePathField, 2 GenericIPAddressField, and 3 IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, relate...

CVE-2014-0474

The 1 FilePathField, 2 GenericIPAddressField, and 3 IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, relate...

CVE-2014-0474

CVE-2014-0474 affects Django’s model fields FilePathField, GenericIPAddressField and IPAddressField. The root cause is improper type conversion during query argument handling in affected Django versions (1.4.x before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2), re...

USN-2169-2 python-django regression

USN-2169-1 fixed vulnerabilities in Django. The upstream security patch for CVE-2014-0472 introduced a regression for certain applications. This update fixes the problem. Original advisory details: Benjamin Bach discovered that Django incorrectly handled dotted Python paths when using the reverse...

MySQL typecasting

When using a MySQL database, Django don't perform explicit conversion of the fields: FilePathField GenericIPAddressField IPAddressField If a query is performed without first converting values to the appropriate type, this can produce unexpected results, similar to what would occur if the query...

USN-2169-1 python-django vulnerabilities

Benjamin Bach discovered that Django incorrectly handled dotted Python paths when using the reverse function. An attacker could use this issue to cause Django to import arbitrary modules from the Python path, resulting in possible code execution. CVE-2014-0472 Paul McMillan discovered that Django...

CVE-2014-0474

The 1 FilePathField, 2 GenericIPAddressField, and 3 IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, relate...

UBUNTU-CVE-2014-0474

The 1 FilePathField, 2 GenericIPAddressField, and 3 IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, relate...

OpenJDK: image conversion out of bounds read (2D, 8014102)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, 6u60 and earlier, 5.0u51 and earlier, and Embedded 7u40 and earlier allows remote attackers to affect confidentiality via unknown vectors related to 2D...

CVE-2014-1757

Microsoft Word 2007 SP3 and 2010 SP1 and SP2, and Office Compatibility Pack SP3, allocates memory incorrectly for file conversions from a binary aka .doc format to a newer format, which allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office File Format...

Design/Logic Flaw

Microsoft Word 2007 SP3 and 2010 SP1 and SP2, and Office Compatibility Pack SP3, allocates memory incorrectly for file conversions from a binary aka .doc format to a newer format, which allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office File Format...

CVE-2014-1757

Microsoft Word 2007 SP3 and 2010 SP1 and SP2, and Office Compatibility Pack SP3, allocates memory incorrectly for file conversions from a binary aka .doc format to a newer format, which allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office File Format...

74CMS Sql注入漏洞一枚2

简要描述： 过滤不严。 详细说明： 在plus/ajaxuser.php中 elseif$act =='checkusname' requireonceQISHIROOTPATH.'include/funuser.php'; $usname=trim$POST'usname'; if strcasecmpQISHIDBCHARSET,"utf8"!=0 $usname=iconv"utf-8",QISHIDBCHARSET,$usname; $user=getuserinusername$usname; empty$user?exit"true":exit"false"; 也是iconv...