CVE-2017-5628

An issue was discovered in Artifex Software, Inc. MuJS before 8f62ea10a0af68e56d5c00720523ebcba13c2e6a. The MakeDay function in jsdate.c does not validate the month, leading to an integer overflow when parsing a specially crafted JS file...

WEB SCHEDULE vulnerable to cross-site scripting

Overview WEB SCHEDULE provided by Olive Design contains a cross-site scripting vulnerability CWE-79 due to a flaw in processing the month parameter. Impact An artbitrary script may be executed on the user's web browser. Solution Do not use WEB SCHEDULE WEB SCHEDULE is no longer being developed or...

Calendar Widget Month + Agenda - Exported components, External URLs, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Calendar Widget Month + Agenda published at the 'play' market has multiple vulnerabilities...

Calendar Widget: Month+Agenda - Exported ContentProvider, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Calendar Widget: Month+Agenda published at the 'play' market has multiple vulnerabilities...

Month Calendar Widget - Corrupted files, Exported components vulnerabilities

HackApp vulnerability scanner discovered that application Month Calendar Widget published at the 'play' market has multiple vulnerabilities...

German in a Month Free - Base64 encoded String, Customized SSL vulnerabilities

HackApp vulnerability scanner discovered that application German in a Month Free published at the 'play' market has multiple vulnerabilities...

WordPress Plugin Count Per Day SQL Injection Vulnerability

WordPress is a blogging platform developed using the PHP language that allows users to set up their own websites on servers that support PHP and MySQL databases. A SQL injection vulnerability exists in the WordPress plugin Count Per Day. Due to insufficient filtering of data passed as input to th...

Google 'Project Fi' Wireless Service: 10 Amazing Facts

Google has just launched its long-rumored wireless cellular service that comes up to give a tough competition for AT&T and Verizon communication. Yes! A wireless Service for Cell Phone users. The web Internet giant, Google is now becoming a Mobile Virtual Network Operator MVNO by offering its...

Restricted blog post visible in the month summary page

Steps to reproduce: 1. create a new blog post, and restrict it to yourself 2. log in as another user and go to Blogs in sidebar 3. blog is not visible in the blogs summary page 4. click a visible blog in the same month 5. click the month link in the breadcrumb 5. restricted blog title and excerpt...

Restricted blog post visible in the month summary page

Steps to reproduce: 1. create a new blog post, and restrict it to yourself 2. log in as another user and go to Blogs in sidebar 3. blog is not visible in the blogs summary page 4. click a visible blog in the same month 5. click the month link in the breadcrumb 5. restricted blog title and excerpt...

BirdBlog 1.4 /admin/entries.php month Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/21184/info BirdBlog is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code...

CVE-2012-5567

Multiple cross-site scripting XSS vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.18, as used in Horde Groupware Webmail Edition before 4.0.9, allow remote attackers to inject arbitrary web script or HTML via crafted event location parameters in the 1 month, 2 monthlist, or ...

PT-2013-5886

Name of the Vulnerable Software and Affected Versions Complete Gallery Manager plugin versions prior to 3.3.4 rev40279 Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the /frames/upload-images.php endpoint, and then...

DHS Chief Uses 'Sandy' to Underscore Cybersecurity Threats

While the eastern United States recovers from this week’s devastasting storm, the nation’s Homeland Security chief used “Superstorm Sandy” to promote the importance of national cybersecurity protection. “One of the possible areas of attack, of course, is attacks on our nation’s control systems —...

Survey: SMBs Remain Blissfully Unfazed by Cyberthreats

More than three quarters of small business owners claim their companies are safe from cyber attacks, yet only 17 percent of those businesses have implemented a formal cybersecurity plan. This is just one of many problems for small businesses in the digital realm, according to a joint survey .PDF...

Classmate of Lulzsec Hacker arrested and accused as another Lulzsec teammate

The two students accused of Sony Pictures hack participated in Cyber Defense Competition team exercises at the University of Advanced Technology in Arizona. US authorities have reportedly arrested a second suspected member of hacking group LulzSec on charges of taking part in an extensive compute...

CVE-2011-5140

Multiple SQL injection vulnerabilities in the blog module 1.0 for DiY-CMS allow remote attackers to execute arbitrary SQL commands via the 1 start parameter to a tags.php, b list.php, c index.php, d mainindex.php, e viewpost.php, f archive.php, g control/approvecomments.php, h...

PT-2012-2118

Name of the Vulnerable Software and Affected Versions DiY-CMS blog module version 1.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the start parameter to various API endpoints, including "tags.php", "list.php", "index.php", "main index.php"...

CVE-2011-5140: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the blog module 1.0 for DiY-CMS allow remote attackers to execute arbitrary SQL commands via the 1 start parameter to a tags.php, b list.php, c index.php, d mainindex.php, e viewpost.php, f archive.php, g control/approvecomments.php, h...

Hero Framework 3.69 Cross Site Scripting

Hero Framework 3.69 Remote Reflected Cross-Site Scripting Vulnerability Vendor: Electric Function, Inc. Product web page: http://www.heroframework.com Affected version: 3.69 Summary: Hero formerly Caribou CMS is a white label, open source PHP website content management system CMS and development...