CVE-2014-2330: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Multisite GUI in CheckMK before 1.2.5i2 allow remote attackers to hijack the authentication of users for requests that 1 upload arbitrary snapshots, 2 delete arbitrary files, or possibly have other unspecified impact via unknown...

PT-2015-3705

Name of the Vulnerable Software and Affected Versions Check MK versions prior to 1.2.5i2 Description The issue affects the Multisite GUI in Check MK, where multiple cross-site request forgery CSRF vulnerabilities exist. These vulnerabilities allow remote attackers to hijack the authentication of...

WordPress YouTube Embed 3.3.2 Cross Site Scripting Vulnerability

WordPress YouTube Embed plugin version 3.3.2 suffers from a stored cross site scripting vulnerability. Details ================ Software: YouTube Embed Version: 3.3.2 Homepage: https://wordpress.org/plugins/youtube-embed/ CVE ID: CVE-2015-6535 Pending CWE ID: CWE-79 CVSS: 5.5 Medium;...

WordPress YouTube Embed 3.3.2 Cross Site Scripting

Details ================ Software: YouTube Embed Version: 3.3.2 Homepage: https://wordpress.org/plugins/youtube-embed/ CVE ID: CVE-2015-6535 Pending CWE ID: CWE-79 CVSS: 5.5 Medium; AV:N/AC:L/Au:S/C:P/I:P/A:N Description ================ A stored XSS vulnerability in YouTube Embed 3.3.2 and...

check-mk: multiple flaws fixed in versions 1.2.4p4 and 1.2.5i4

Multiple cross-site scripting XSS vulnerabilities in the multisite component in CheckMK before 1.2.4p4 and 1.2.5 before 1.2.5i4 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors to the 1 renderstatusicons function in htmllib.py or 2 ajaxaction functio...

WordPress Multisite Plugin Manager Plugin <= 3.1.1 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

WordPress Multisite Plugin Manager Plugin <= 3.1.1 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

WPS Hide Login 1.0 - CSRF

CSRF security issue when saving option value in single site and multisite mode...

WordPress 3.0 - 3.9.1 Authenticated Cross-Site Scripting (XSS) in Multisite

...

CVE-2014-5338: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the multisite component in CheckMK before 1.2.4p4 and 1.2.5 before 1.2.5i4 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors to the 1 renderstatusicons function in htmllib.py or 2 ajaxaction functio...

CVE-2014-5240

Cross-site scripting XSS vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL...

DEBIAN-CVE-2014-5240

Cross-site scripting XSS vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL...

Cross site scripting

Cross-site scripting XSS vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL...

UBUNTU-CVE-2014-5240

Cross-site scripting XSS vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL...

CVE-2014-5240

Cross-site scripting XSS vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL...

CVE-2014-5240

CVE-2014-5240 is an XSS in WordPress prior to 3.9.2 (Multisite enabled) affecting wp-includes/pluggable.php via a crafted avatar URL. The vulnerability allows remote authenticated administrators to inject arbitrary script/HTML and can enable a Super Admin privilege escalation. The issue is docume...

CVE-2014-5240

Cross-site scripting XSS vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL...

CVE-2014-5240

Cross-site scripting XSS vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL...

PT-2014-6358

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.9.2 Description A cross-site scripting XSS issue allows remote authenticated administrators to inject arbitrary web script or HTML and obtain Super Admin privileges via a crafted avatar URL when Multisite is...

CVE-2014-5240: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL...