Multiple vulnerabilities in Vulcan theme for WordPress + WAF bypass

Hello 3APA3A! Let's back to vulnerabilities, which I disclosed in April 2011, which can be used for DDoS attacks on other sites, e.g. with my DAVOSET http://seclists.org/fulldisclosure/2015/Jun/111. In addition to hundreds of themes, which I wrote about in previous years, here is another theme fo...

CVE-2015-3660

Cross-site scripting XSS vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content...

CVE-2015-3658

The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to...

Design/Logic Flaw

The SQLite authorizer in the Storage functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict access to SQL functions, which allows remote attackers to execute arbitrary code or cau...

CVE-2015-3660

Cross-site scripting XSS vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content...

CVE-2015-3660

This CVE (CVE-2015-3660) affects Safari/WebKit PDF rendering. Vulnerable if using Safari before 6.2.7, 7.x before 7.1.7, or 8.x before 8.0.7; an attacker can inject arbitrary script/HTML via a crafted URL in embedded PDF content (XSS). Remediation is to update to non-affected Safari/WebKit versio...

CVE-2015-3660

Cross-site scripting XSS vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content...

CVE-2015-3660: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content...

Massachusetts Institute of Technology（MIT）invention vulnerabilities automatically repair system-vulnerability warning-the black bar safety net

! In this month's Computer Society programming languages design and implementation Conference on the Association for Computing Machinery's Programming Language Design and Implementation, the MIT researchers demonstrated a new system, it is possible by introducing other, more security of applicati...

CVE-2014-9735

The ThemePunch Slider Revolution revslider plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to 1 upload and execute arbitrary files via an updateplugin...

CVE-2014-9735

The ThemePunch Slider Revolution revslider plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to 1 upload and execute arbitrary files via an updateplugin...

CVE-2014-9735: Undefined Security Weakness

The ThemePunch Slider Revolution revslider plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to 1 upload and execute arbitrary files via an updateplugin...

CVE-2015-4199: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine PRE module on UBR devices allows remote attackers to cause a denial of service NULL pointer free and module crash by triggering intermittent connectivity with many IPv6 CPE devices, aka Bug ID...

CVE-2015-4200: Undefined Security Weakness

Memory leak in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine PRE module on UBR devices allows remote attackers to cause a denial of service memory consumption by triggering an error during CPE negotiation, aka Bug ID CSCug00885...

[SECURITY] Fedora 22 Update: abrt-2.6.0-1.fc22

abrt is a tool to help users to detect defects in applications and to create a bug report with all information needed by maintainer to fix it. It uses plugin system to extend its functionality...

Cross site scripting

Cross-site scripting XSS vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the posttitle parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview...

Cross-site request forgery (CSRF) vulnerability in Spina gem

"Spina::ApplicationController actions didn't have CSRF protection. This causes a CSRF vulnerability across the entire engine which includes administrative functionality such as creating users, changing passwords, and media management."...

Oracle Linux 5 : kernel (ELSA-2015-1042)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1042 advisory. - fs pipe: fix pipe corruption and iovec overrun on partial copy Mateusz Guzik 1203787 CVE-2015-1805 Tenable has extracted the preceding description block...

SOL16704 - cURL and libcurl vulnerability CVE-2015-3143

Note: As of February 17, 2015, AskF5 Security Advisory articles include the Severity value. Security Advisory articles published before this date do not list a Severity value. Vulnerability Recommended Actions If the previous table lists a version in the Versions known to be not vulnerable column...

ElasticSearch exposure local arbitrary file read vulnerability, impact 1. 4. 5 and 1. 5. Before 2 all versions-bug warning-the black bar safety net

! Recently in exploit-db on the aerator out of the ElasticSearch plug-in functionality directory traversal Path Transversal cause local arbitrary file read vulnerability, impact 1. 4. 5 and 1. 5. Before 2 All version. In zoomeye on casually looking for a few tried, found vulnerabilities in the ar...