Multiple vulnerabilities in Vulcan theme for WordPress + WAF bypass

Hello 3APA3A! Let's back to vulnerabilities, which I disclosed in April 2011, which can be used for DDoS attacks on other sites, e.g. with my DAVOSET http://seclists.org/fulldisclosure/2015/Jun/111. In addition to hundreds of themes, which I wrote about in previous years, here is another theme fo...

CVE-2015-3660

Cross-site scripting XSS vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content...

CVE-2015-3658

The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to...

Design/Logic Flaw

The SQLite authorizer in the Storage functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict access to SQL functions, which allows remote attackers to execute arbitrary code or cau...

CVE-2015-3660

Cross-site scripting XSS vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content...

CVE-2015-3660

This CVE (CVE-2015-3660) affects Safari/WebKit PDF rendering. Vulnerable if using Safari before 6.2.7, 7.x before 7.1.7, or 8.x before 8.0.7; an attacker can inject arbitrary script/HTML via a crafted URL in embedded PDF content (XSS). Remediation is to update to non-affected Safari/WebKit versio...

CVE-2015-3660

Cross-site scripting XSS vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content...

Massachusetts Institute of Technology（MIT）invention vulnerabilities automatically repair system-vulnerability warning-the black bar safety net

! In this month's Computer Society programming languages design and implementation Conference on the Association for Computing Machinery's Programming Language Design and Implementation, the MIT researchers demonstrated a new system, it is possible by introducing other, more security of applicati...

CVE-2014-9735

The ThemePunch Slider Revolution revslider plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to 1 upload and execute arbitrary files via an updateplugin...

CVE-2014-9735

The ThemePunch Slider Revolution revslider plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to 1 upload and execute arbitrary files via an updateplugin...

[SECURITY] Fedora 22 Update: abrt-2.6.0-1.fc22

abrt is a tool to help users to detect defects in applications and to create a bug report with all information needed by maintainer to fix it. It uses plugin system to extend its functionality...

Cross site scripting

Cross-site scripting XSS vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the posttitle parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview...

Cross-site request forgery (CSRF) vulnerability in Spina gem

"Spina::ApplicationController actions didn't have CSRF protection. This causes a CSRF vulnerability across the entire engine which includes administrative functionality such as creating users, changing passwords, and media management."...

Oracle Linux 5 : kernel (ELSA-2015-1042)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1042 advisory. - fs pipe: fix pipe corruption and iovec overrun on partial copy Mateusz Guzik 1203787 CVE-2015-1805 Tenable has extracted the preceding description block...

SOL16704 - cURL and libcurl vulnerability CVE-2015-3143

Note: As of February 17, 2015, AskF5 Security Advisory articles include the Severity value. Security Advisory articles published before this date do not list a Severity value. Vulnerability Recommended Actions If the previous table lists a version in the Versions known to be not vulnerable column...

ElasticSearch exposure local arbitrary file read vulnerability, impact 1. 4. 5 and 1. 5. Before 2 all versions-bug warning-the black bar safety net

! Recently in exploit-db on the aerator out of the ElasticSearch plug-in functionality directory traversal Path Transversal cause local arbitrary file read vulnerability, impact 1. 4. 5 and 1. 5. Before 2 All version. In zoomeye on casually looking for a few tried, found vulnerabilities in the ar...

Hikvision DS-7108HWI-SH XML Injection / Abuse Issues

Hello list! There are vulnerabilities in Hikvision DS-7108HWI-SH. These are XML Injection, Abuse of Functionality and Brute Force vulnerabilities. All these vulnerabilities are present in other IP cameras and DVR of Hikvision. ------------------------- Affected vendors: -------------------------...

SUSE SLED10 / SLES10 Security Update : kernel (SUSE-SU-2013:0674-1)

This Linux kernel update fixes various security issues and bugs in the SUSE Linux Enterprise 10 SP4 kernel. The following security issues have been fixed : CVE-2013-0871: A race condition in ptrace2 could be used by local attackers to crash the kernel and/or execute code in kernel context...

Hikvision DS-2CD2012-I XML Injection / Abuse Issues

Hello list! There are vulnerabilities in Hikvision DS-2CD2012-I. These are XML Injection, Abuse of Functionality and Brute Force vulnerabilities. All these vulnerabilities are present in other IP cameras and DVR of Hikvision. ------------------------- Affected vendors: -------------------------...

openSUSE Security Update : gnu_parallel (openSUSE-2015-358)

GNU parallel was updated to version 20150422 to fix one security issue, several bugs and add functionality. The following vulnerability was fixed : - A local attacker could make a user overwrite one of his own files with a single byte when using --compress, --tmux, --pipe, --cat or --fifo when...