Wordpress BP Group Documents Plugin 1.2.1 - Multiple Vulnerabilities

Stored XSS vulnerability in BP Group Documents 1.2.1 Description ================ Stored XSS vulnerability in BP Group Documents 1.2.1 Vulnerability ================ “Display name” and “Description” fields are not escaped, meaning any tags including script tags can be stored in them. Proof of...

WordPress Plugin BP Group Documents 1.2.1 - Multiple Vulnerabilities

Details ================ Software: BP Group Documents Version: 1.2.1 Homepage: http://wordpress.org/plugins/bp-group-documents/ CVSS: 8 High; AV:N/AC:L/Au:S/C:P/I:P/A:C Description ================ Stored XSS vulnerability in BP Group Documents 1.2.1 Vulnerability ================ “Display name”...

WordPress BP Group Documents多个漏洞

WordPress是一款内容管理系统。 WordPress BP Group Documents“显示名称”和“描述”字段存在存储型跨站脚本漏洞，跨站请求伪造和文件移动漏洞。 0 BP Group Documents 1.2.1 厂商补丁： WordPress ----- WordPress 1.2.2版本以修复此漏洞，建议用户下载使用： http://wordpress.org/plugins/bp-group-documents/ Stored XSS ================ Go to the upload form, select a document to uploa...

WordPress Plugin BP Group Documents 1.2.1 - Multiple Vulnerabilities

WordPress Plugin BP Group Documents 1.2.1 - Multiple Vulnerabilities Details ================ Software: BP Group Documents Version: 1.2.1 Homepage: http://wordpress.org/plugins/bp-group-documents/ CVSS: 8 High; AV:N/AC:L/Au:S/C:P/I:P/A:C Description ================ Stored XSS vulnerability in BP...

WordPress BP Group Documents Plugin 1.2.1 - Multiple Vulnerabilities

BP Group Documents plugin is prone to multiple vulnerabilities. 1. Stored XSS - “Display name” and “Description” fields are not escaped. It means that any tags can be stored in them. 2. Cross-site request forgery - the fields are vulnerable and an unauthenticated user can logged in user to edit a...

Red Hat JBoss Seam Framework XXE Information Disclosure (CVE-2013-6447)

An information disclosure vulnerability has been reported in Red Hat JBoss Seam Framework. The vulnerability is due to an incorrectly configured XML parser accepting XML eXternal Entities XXE from untrusted sources being used by the ExecutionHandler, PollHandler, and SubscriptionHandler classes...

[OWASP iGoat] Security learning tool for iOS developers

The OWASP iGoat project is a security learning tool for iOS developers to learn about security weaknesses in iOS -- by breaking things as well as fixing them. iGoat is available ONLY in source code format, and this is the official repository for that code. On the Downloads tab here, you will find...

Edward Snowden obtained classified NSA documents by stealing Coworker’s Password

We are quite aware of the leaks that the Whistleblower Edward Snowden carried out against the US National Security Agency NSA and after reading every related update, watching every document that he provided to various news websites, you all are left with a question in mind that, How he could carr...

Angry Birds and other Mobile Gaming apps leaking your private information to NSA

Are you fond of playing games on your Smartphone like Angry Birds or Subway Surfer?? You should now stop wasting your time, because NSA is utilizing your gaming energy in the best possible way. According to the latest documents leaked by former U.S. Government contractor Edward Snowden, Some of t...

Threat Outbreak Alert: Fake Financial Documents Email Messages on January 20, 2014

Medium Alert ID: 32491 First Published: 2014 January 21 21:06 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain financial documents for the recipient. The text in the email message attempts to convince the recipient to ope...

EFF Activists, Journalists Hit By Targeted Malware Attack

Phishing and malware attacks are among the more democratic and populist threats on the Internet. You don’t have to stand in the crowd in order to be targeted; the attackers will get to you sooner or later. But while most malware campaigns are aimed at the masses, attackers often save their best...

Microsoft Office multiple security vulnerabilities

Multiple memory corruptions on Microsoft Word documents parsing...

Threat Outbreak Alert: Fake Financial Documents Email Messages on January 14, 2014

Medium Alert ID: 32428 First Published: 2014 January 14 15:42 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain financial documents for the recipient. The text in the email message attempts to convince the recipient to ope...

Threat Outbreak Alert: Fake Bank Documents Email Messages on January 13, 2014

Medium Alert ID: 32417 First Published: 2014 January 14 15:38 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain bank documents for the recipient. The text in the email message attempts to convince the recipient to open the...

CVE-2013-6997

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange OX AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 an HTML email with crafted CSS code containing wildcards or 2 office documents containing "crafted hyperlinks with script URL handler...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange OX AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 an HTML email with crafted CSS code containing wildcards or 2 office documents containing "crafted hyperlinks with script URL handler...

CVE-2013-6997

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange OX AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 an HTML email with crafted CSS code containing wildcards or 2 office documents containing "crafted hyperlinks with script URL handler...

Open-Xchange Security Advisory 2014-01-06

Open-Xchange Security Advisory 2014-01-06 Product: Open-Xchange AppSuite Vendor: Open-Xchange GmbH Internal reference: 30203 Bug ID Vulnerability type: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page Vulnerable version: 7.4.0 and earlier Vulnerable component: backend Fixe...

Threat Outbreak Alert: Fake Financial Documents Email Messages on December 20, 2013

Medium Alert ID: 32251 First Published: 2013 December 23 14:06 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain financial documents for the recipient. The text in the email message attempts to convince the recipient to op...

Threat Outbreak Alert: Fake Invoice Documents Attachment Email Messages on December 18, 2013

Medium Alert ID: 32216 First Published: 2013 December 18 17:34 GMT Version: 1 Summary Cisco Security has detected significant activity related to German-language spam email messages that claim to contain invoice documents for the recipient. The text in the email message attempts to convince the...