WordPress Contact Form DB Plugin <= 2.8.17 - Reflected XSS

This plugin is prone to a reflected cross site scripting vulnerability in Admin Area. Solution Update the plugin...

. NET remote code execution MS14-0 2 6/CVE-2 0 1 4-1 8 0 6-a vulnerability warning-the black bar safety net

今天 看 到 小 猪 在 safekey 的 群 里面 说 关注 了 很 久 了 一 个 .NET a remote code execution vulnerability exp discloses, then immediately go to exploit-db to find the next find the it. This is Microsoft in 1 4 years 5 months has released a patch for a vulnerability that is MS14-0 2 6/CVE-2 0 1 4-1 8 0 6, bug the...

Design/Logic Flaw

The DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8 before 1.8.28-cert8 and 11.6 before 11.6-cert8 allows remote authenticated users to gain privileges via a call from an external protoco...

CVE-2014-8418

The DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8 before 1.8.28-cert8 and 11.6 before 11.6-cert8 allows remote authenticated users to gain privileges via a call from an external protoco...

CVE-2014-8418

The DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8 before 1.8.28-cert8 and 11.6 before 11.6-cert8 allows remote authenticated users to gain privileges via a call from an external protoco...

CVE-2014-8418

The DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8 before 1.8.28-cert8 and 11.6 before 11.6-cert8 allows remote authenticated users to gain privileges via a call from an external protoco...

FreeBSD : asterisk -- Multiple vulnerabilities (a92ed304-716c-11e4-b008-001999f8d30b)

The Asterisk project reports : AST-2014-012 - Mixed IP address families in access control lists may permit unwanted traffic. AST-2014-018 - AMI permission escalation through DB dialplan function. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

RobotStats 1.0 - HTML Injection

Title : RobotStats v1.0 HTML Injection Vulnerability Author : ZoRLu / [email protected] / [email protected] Home : http://milw00rm.com / its online Twitter : https://twitter.com/milw00rm or @milw00rm Date : 22.11.2014 Demo : http://alpesoiseaux.free.fr/robotstats/ Download :...

Event tracking: Belkin router Belkin router）0day overflow vulnerability analysis-vulnerability warning-the black bar safety net

Vulnerability summary Security researcher Marco Vaz in Belkin n750 the model router found a serious vulnerability that can allow an attacker on the victim's device to get Root access permissions i.e. administrator privileges, the vulnerability of the main attacks is the router's Web...

Enterprise Manager Install fails with Patched Database Error

Purpose If the Veeam Backup Enterprise Manager software is moved, or needs to be reinstalled and it was previously patched it errors out with the following error: Cause The SQL database that is being reused contains table entries that mark it as having been used with a newer version the version o...

Microsoft SQL Server SQLi Escalate Db_Owner

This module can be used to escalate SQL Server user privileges to sysadmin through a web SQL Injection. In order to escalate, the database user must to have the dbowner role in a trustworthy database owned by a sysadmin user. Once the database user has the sysadmin role, the mssqlpayloadsqli modu...

CVE-2014-6488

CVE-2014-6488 affects Oracle Enterprise Manager components (Grid Control EM Base Platform: 10.2.0.5, 11.1.0.1; EM DB Control: 11.1.0.7, 11.2.0.3, 11.2.0.4; EM Plugin for DB: 12.1.0.4–12.1.0.6) in the Content Management sub-component. The vulnerability is described as unspecified with remote authe...

Two XSS in Contact Form DB WordPress plugin

Advisory ID: HTB23233 Product: Contact Form DB WordPress plugin Vendor: Michael Simpson Vulnerable Versions: 2.8.13 and probably prior Tested Version: 2.8.13 Advisory Publication: September 17, 2014 without technical details Vendor Notification: September 17, 2014 Vendor Patch: September 25, 2014...

CVE-2014-7139

Multiple cross-site scripting XSS vulnerabilities in the Contact Form DB aka CFDB and contact-form-7-to-database-extension plugin before 2.8.16 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 form or 2 enc parameter in the CF7DBPluginShortCodeBuilder page to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Contact Form DB aka CFDB and contact-form-7-to-database-extension plugin before 2.8.16 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 form or 2 enc parameter in the CF7DBPluginShortCodeBuilder page to...

CVE-2014-7139

Multiple cross-site scripting XSS vulnerabilities in the Contact Form DB aka CFDB and contact-form-7-to-database-extension plugin before 2.8.16 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 form or 2 enc parameter in the CF7DBPluginShortCodeBuilder page to...

CVE-2014-7139

CVE-2014-7139 documents two XSS vulnerabilities in the WordPress plugin Contact Form DB (aka CFDB/contact-form-7-to-database-extension) up to version 2.8.13. The root cause is insufficient sanitization in the CF7DBPluginShortCodeBuilder page, allowing an attacker to craft GET parameters (form and...

WordPress Contact Form DB 2.8.13 Cross Site Scripting Vulnerability

WordPress Contact Form DB plugin version 2.8.13 suffers from a cross site scripting vulnerability. Product: Contact Form DB WordPress plugin Vendor: Michael Simpson Vulnerable Versions: 2.8.13 and probably prior Tested Version: 2.8.13 Advisory Publication: September 17, 2014 without technical...

WordPress Contact Form DB 2.8.13 Cross Site Scripting

Advisory ID: HTB23233 Product: Contact Form DB WordPress plugin Vendor: Michael Simpson Vulnerable Versions: 2.8.13 and probably prior Tested Version: 2.8.13 Advisory Publication: September 17, 2014 without technical details Vendor Notification: September 17, 2014 Vendor Patch: September 25, 2014...

Contact Form DB 2.8.13 - 2 x Cross-Site Scripting (XSS)

The contact-form-7-to-database-extension WordPress plugin was affected by a 2 x Cross-Site Scripting XSS security vulnerability...