CVE-2017-12946

The CVE-2017-12946 issue affects the WordPress Easy Modal plugin prior to 2.1.0. The vulnerability is an SQL injection in a delete action (parameters: id, ids, or modal) passed to wp-admin/admin.php, and is exploitable by users with administrative access. In practice, an authenticated administrat...

CVE-2017-12947

The CVE-2017-12947 entry corresponds to the WordPress Easy Modal plugin (versions before 2.1.0). The vulnerability is an SQL injection in the untrash action via wp-admin/admin.php, exploitable by administrators. Affected component: classes\controller\admin\modals.php. The available sources descri...

CVE-2017-12947: Improper Neutralization of Special Elements used in an SQL Command

classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in an untrash action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators...

CVE-2017-12946: Improper Neutralization of Special Elements used in an SQL Command

classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators...

PT-2017-12789

Name of the Vulnerable Software and Affected Versions Easy Modal plugin versions prior to 2.1.0 Description The issue concerns SQL injection in the delete action of the Easy Modal plugin, specifically affecting the id, ids, or modal parameter to wp-admin/admin.php. This can be exploited by...

PT-2017-12790

Name of the Vulnerable Software and Affected Versions Easy Modal plugin versions prior to 2.1.0 Description The issue concerns SQL injection in the Easy Modal plugin for WordPress. It affects the untrash action and involves the id, ids, or modal parameter to "wp-admin/admin.php". This exploit is...

USN-3391-2 ubufox update

USN-3391-1 fixed vulnerabilities in Firefox. This update provides the corresponding update for Ubufox. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to...

Mozilla: Spoofing following page navigation with data: protocol and modal alerts (MFSA 2017-19)

On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary domains following page navigation, spoofing of the origin of the modal alert from the iframe content. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox ...

CVE-2017-7783

If a long user name is used in a username/password combination in a site URL such as " http://UserName:[email protected]", the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service. This vulnerability affects Firefox 55...

UBUNTU-CVE-2017-7791

On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary domains following page navigation, spoofing of the origin of the modal alert from the iframe content. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox ...

UBUNTU-CVE-2017-7783

If a long user name is used in a username/password combination in a site URL such as " http://UserName:[email protected]", the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service. This vulnerability affects Firefox 55...

PT-2017-17941

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 55 Description The issue occurs when a long user name is used in a username/password combination in a site URL, causing the resulting modal prompt to hang in a non-responsive state or crash. This results in a denial o...

WordPress Easy Modal 2.0.17 Plugin - SQL Injection Vulnerability

Exploit for php platform in category web applications WordPress Easy Modal Plugin Multiple Security Vulnerabilities Advisory Title: WordPress Easy Modal Plugin Multiple Vulnerabilities Advisory URL: http://www.defensecode.com/advisories.php Software: WordPress Easy Modal plugin Language: PHP...

WordPress Easy Modal 2.0.17 SQL Injection

DefenseCode ThunderScan SAST Advisory WordPress Easy Modal Plugin Multiple Security Vulnerabilities Advisory ID: DC-2017-01-007 Advisory Title: WordPress Easy Modal Plugin Multiple Vulnerabilities Advisory URL: http://www.defensecode.com/advisories.php Software: WordPress Easy Modal plugin...

Easy Modal <= 2.0.17 - Authenticated SQL Injection

This can only be exploited by a user who already has access to the admin with a valid nonce. During the security analysis, ThunderScan discovered SQL injection vulnerabilities in the Easy Modal WordPress Plugin. The easiest way to reproduce the vulnerability is to visit the provided URL while bei...

Easy Modal <= 2.0.17 - Authenticated SQL Injection

This can only be exploited by a user who already has access to the admin with a valid nonce. During the security analysis, ThunderScan discovered SQL injection vulnerabilities in the Easy Modal WordPress Plugin. The easiest way to reproduce the vulnerability is to visit the provided URL while bei...

WordPress Easy Modal plugin <=2.0.17 - SQL Injection vulnerability

SQL Injection vulnerability found in Easy Modal WordPress plugin version 2.0.17 and earlier versions by Neven Biruski DefenseCode. Possible if a user with administrator rights tricked to follow the crafted link, users with lower rights also could access and abuse the database. Solution Update the...

WordPress Plugin Easy Modal 2.0.17 - SQL Injection

DefenseCode ThunderScan SAST Advisory WordPress Easy Modal Plugin Multiple Security Vulnerabilities Advisory ID: DC-2017-01-007 Advisory Title: WordPress Easy Modal Plugin Multiple Vulnerabilities Advisory URL: http://www.defensecode.com/advisories.php Software: WordPress Easy Modal plugin...

chromium-browser: ui spoofing in blink

Inappropriate implementation in modal dialog handling in Blink in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to prevent a full screen warning from being displayed via a crafted HTML page...

PT-2017-16293

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 60.0.3112.78 Opera versions prior to 60.0.3112.78 Description The issue is related to an inappropriate implementation in modal dialog handling in Blink, which allowed a remote attacker to prevent a full screen...