1021 matches found
POP Peeper 4.0.1 - Overwrite (SEH)
''' Exploit Title: POP Peeper SEH Over-write. Date: 9/14/2015 Exploit Author: UnN0n Software Link: http://www.esumsoft.com/download Version: v4.0.1 Tested on: Windows 7 x8632 BIT DUMP: ''' EAX 00000000 ECX 20203029 EDX 77C5660D ntdll.77C5660D EBX 00000000 ESP 0012EC5C EBP 0012EC7C ESI 00000000 ED...
Shopify: customers password hash leak!!!!
An endpoint in the Draft Order feature would return a serialized version of the Customer that contained the account password hashed and salted as well as the last password reset token when available...
Design/Logic Flaw
WordPress before 4.2.3 does not properly verify the editposts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php...
WordPress Draft Creation Vulnerability
WordPress is a use of PHP language development blog platform, users can support PHP and MySQL database server set up their own weblog. WordPress has a security vulnerability, users with Subscriber rights can create drafts through the Quick Draft feature...
WordPress < 3.7.9 / 3.8.9 / 3.9.7 / 4.1.6 / 4.2.3 Multiple Vulnerabilities
According to its version number, the WordPress application running on the remote web server is either version 3.7.x prior to 3.7.9, 3.8.x prior to 3.8.9, 3.9.x prior to 3.9.7, 4.1.x prior to 4.1.6, or 4.2.x prior to 4.2.3. It is, therefore, potentially affected by the following vulnerabilities : ...
Updated wordpress package fixes security vulnerabilities
WordPress versions 4.2.2 and earlier are affected by a cross-site scripting vulnerability, which could allow users with the Contributor or Author role to compromise a site CVE-2015-5622. WordPress versions 4.2.2 and earlier are affected by an issue where it was possible for a user with Subscriber...
MGASA-2015-0290 Updated wordpress package fixes security vulnerabilities
WordPress versions 4.2.2 and earlier are affected by a cross-site scripting vulnerability, which could allow users with the Contributor or Author role to compromise a site CVE-2015-5622. WordPress versions 4.2.2 and earlier are affected by an issue where it was possible for a user with Subscriber...
SUSE SLED12 / SLES12 Security Update : MozillaFirefox / mozilla-nss (SUSE-SU-2014:1510-1)
update to Firefox 31.2.0 ESR bnc900941 - MFSA 2014-74/CVE-2014-1574/CVE-2014-1575 bmo1001994, bmo1011354, bmo1018916, bmo1020034, bmo1023035, bmo1032208, bmo1033020, bmo1034230, bmo1061214, bmo1061600, bmo1064346, bmo1072044, bmo1072174 Miscellaneous memory safety hazards rv:33.0/rv:31.2 - MFSA...
Android SMS Resend
INTRODUCTION ================================== In Android 5.0, an unprivileged app can resend all the SMS stored in the user's phone to their corresponding recipients or senders without user interaction. No matter whether these SMS are sent to or received from other people. This may leads to...
Android SMS Resend Vulnerability
Android versions prior to 5.0 allow an unprivileged application the ability to resend all the SMS's stored in the users phone. INTRODUCTION ================================== In Android 5.0, an unprivileged app can resend all the SMS stored in the user's phone to their corresponding recipients or...
Draft retrieval in the editor doesn't respect page or space permissions
Drafts are supposed to be per user and private but given a draft id, which should be easy to guess as they are sequential, you can access the contents of any draft, both for new and existing pages by using the following urls:...
Draft retrieval in the editor doesn't respect page or space permissions
Drafts are supposed to be per user and private but given a draft id, which should be easy to guess as they are sequential, you can access the contents of any draft, both for new and existing pages by using the following urls:...
LG U8120 Mobile Phone MIDI File Remote Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13154/info A remote denial of service vulnerability is reported to affect the LG U8120 Mobile Phone. The report indicates that the issue manifests when an affected phone processes a malicious MIDI file. The following...
WordPress 2.3.1 Unauthorized Post Access Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/26885/info WordPress is prone to a vulnerability that lets unauthorized users read draft posts before they have been published. This issue affects WordPress 2.3.1; other versions may also be affected. NOTE: This BID is...
MailEnable Enterprise <= 2.0 (ASP Version) Multiple Vulnerabilities
No description provided by source. Hi, I'm Soroush Dalili from GrayHatz Security Group GSG. I found multiple bugs in MailEnable Enterprise Edition ASP Version = 2.0 that I listed them below: 1 - Any user can login to web administration site. 2 - Authenticated normal user can gain ADMIN or SYSADMI...
Linksys WAP610N Unauthenticated Root Access Security Vulnerability
No description provided by source. Secure Network - Security Research Advisory Vuln name: Linksys WAP610N Unauthenticated Access With Root Privileges Systems affected: WAP610N Firmware Version: 1.0.01 Systems not affected: -- Severity: High Local/Remote: Remote Vendor URL:...
Final Draft 8 Multiple Stack Buffer Overflows
No description provided by source. Name : Final Draft 8 Multiple Stack Buffer Overflows Vendor Website : http://www.finaldraft.com/index.php Date Released : 29/11/2011 Affected Software : Final Draft 8.02 Researcher : Nick Freeman [email protected] Description...
Threat Outbreak Alert: Fake Draft Attachment Email Messages on March 21, 2014
Medium Alert ID: 33469 First Published: 2014 March 24 15:26 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a draft for the recipient. The text in the email message attempts to convince the recipient to open the attachme...
CVE-2012-6635
wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft...
CVE-2012-6635
wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft...