CVE-2017-9065: Improper Input Validation

In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API...

CVE-2017-9062: Improper Neutralization of Input During Web Page Generation

In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API...

PT-2017-18681

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.7.5 Description The issue is related to a lack of capability checks for post meta data in the XML-RPC API. Recommendations For versions prior to 4.7.5, update to version 4.7.5 or later to resolve the issue...

PT-2017-18678

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.7.5 Description The issue is related to the improper handling of post meta data values in the XML-RPC API. Recommendations For versions prior to 4.7.5, update to version 4.7.5 or later to resolve the issue...

WordPress 2.5.0-4.7.4 - Post Meta Data Values Improper Handling in XML-RPC

...

WordPress <=4.7.4 - Post Meta Data Values Improper Handling in XML-RPC API

WordPress versions starting from 2.5 to 4.7.4 have the improper handling of post meta data values in the XML-RPC Remote Procedure Call API. Discovered and reported by Sam Thomas. Solution Update WordPress core to the latest possible version at least 4.7.5...

Code injection

Symphony 2 2.6.11 has XSS in the metanavigationgroup parameter to content/content.blueprintssections.php...

CVE-2017-8876

Symphony 2 2.6.11 has XSS in the metanavigationgroup parameter to content/content.blueprintssections.php...

CVE-2017-8876

Symphony 2 2.6.11 has XSS in the metanavigationgroup parameter to content/content.blueprintssections.php...

CVE-2017-8876

Symphony 2 2.6.11 has XSS in the metanavigationgroup parameter to content/content.blueprintssections.php...

CVE-2017-8876

Symphony 2 2.6.11 has XSS in the metanavigationgroup parameter to content/content.blueprintssections.php...

CVE-2017-8876

CVE-2017-8876 affects Symphony CMS v2.6.11, where an XSS flaw exists in the user-controlled input of the meta[navigation_group] parameter handled by content/content.blueprintssections.php. The vulnerability enables injection of script/HTML in affected pages, consistent with cross-site scripting d...

PT-2017-18598

Name of the Vulnerable Software and Affected Versions Symphony 2 version 2.6.11 Description The issue concerns a problem with the metanavigation group parameter in the content/content.blueprintssections.php file, which can lead to XSS. Recommendations For Symphony 2 version 2.6.11, avoid using th...

CVE-2017-8876: Improper Neutralization of Input During Web Page Generation

Symphony 2 2.6.11 has XSS in the metanavigationgroup parameter to content/content.blueprintssections.php...

Weblate: Missing filteration of meta characters in full name field on registration page https://demo.weblate.org/accounts/register

Hi there Vulnerability Title: Meta characters are not filtered into full name on registration page Description You haven't filtered control meta characters such as %00 etc in full name field on registration page which allows an attacker to impersonate or hide their real identity within the...

[SECURITY] Fedora 25 Update: kernel-4.10.12-200.fc25

The kernel meta package...

Cross-Site Request Forgery (CSRF)/Cross-Site Scripting (XSS) Vulnerability in Twitter Cards Meta

We recently found that the Twitter Cards Meta contains a cross-site request forgery CSRF/cross-site scripting XSS vulnerability on the plugin’s setting pages,/wp-admin/admin.php?page=twitter-cards-meta. The CSRF potion of the vulnerability was due to a lack of a nonce on the page and a lack of a...

CVE-2017-8098

e107 2.1.4 is vulnerable to cross-site request forgery in plugin-installing, meta-changing, and settings-changing. A malicious web page can use forged requests to make e107 download and install a plug-in provided by the attacker...

CVE-2017-8098: Cross-Site Request Forgery (CSRF)

e107 2.1.4 is vulnerable to cross-site request forgery in plugin-installing, meta-changing, and settings-changing. A malicious web page can use forged requests to make e107 download and install a plug-in provided by the attacker...

PT-2017-18113

Name of the Vulnerable Software and Affected Versions e107 version 2.1.4 Description The issue allows a malicious web page to use forged requests to make e107 download and install a plug-in provided by the attacker, due to cross-site request forgery in plugin-installing, meta-changing, and...