PT-2015-6048

Name of the Vulnerable Software and Affected Versions Junos versions 11.4 through 11.4R11, 12.1X44 through 12.1X44-D34, 12.1X46 through 12.1X46-D24, 12.1X47 through 12.1X47-D9, 12.3X48 through 12.3X48-D9, 12.2 through 12.2R8, 12.3 through 12.3R6, 13.2 through 13.2R5, 13.2X51 through 13.2X51-D19,...

Netsparker 4 - Easier to Use, More Automation and Much More Web Security Checks

Netsparker Web Application Security Scanner version 4. The main highlight of this new version is the new fully automated Form Authentication mechanism; it does not require you to record anything, supports 2 factor authentication and other authentication mechanisms that require a one time code to...

Kadimus - LFI Scan & Exploit Tool

Kadimus is a tool to check sites to lfi vulnerability , and also exploit it Features: Check all url parameters /var/log/auth.log RCE /proc/self/environ RCE php://input RCE data://text RCE Source code disclosure Multi thread scanner Command shell interface through HTTP Request Proxy support...

Debian DLA-19-1 : postgresql-8.4 update

New upstream minor release. Users should upgrade to this version at their next scheduled maintenance window. Noteworthy change : Secure Unix-domain sockets of temporary postmasters started during make check Noah Misch Any local user able to access the socket file could connect as the server's...

(Mobile Pwn2Own) Google Android DHCP Parsing Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Google Android. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of the DHCP options in a DHCP ACK packet. The vulnerability is triggered wh...

Wordpress Fusion Theme Arbitrary File Upload Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL.Fusion is one of the corporate themes. An arbitrary file upload vulnerability exists in the 'fusionoptions' function in the...

Linux Kernel 3.15.6 - PPP-over-L2TP Socket Level Handling Crash (PoC)

Linux Kernel 3.15.6 - PPP-over-L2TP Socket Level Handling Crash PoC / ---------------------------------------------------------------------------------------------------- cve-2014-4943poc.c The PPPoL2TP feature in net/l2tp/l2tpppp.c in the Linux kernel through 3.15.6 allows local users to gain...

Yelp: Missing X-Frame-Options header

URL https://staging.seatme.us/ Vulnerability: The server didn't return an X-Frame-Options header which means that this website could be at risk of a clickjacking attack. The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in...

PT-2015-5655

Name of the Vulnerable Software and Affected Versions Fusion theme version 3.1 for Wordpress Description The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension in a fusion save action. This is due to an unrestricted file upload...

WordPress plugin CrossSlide jQuery cross-site request forgery vulnerability

WordPress is the WordPress Software Foundation a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . CrossSlide jQuery is one of the implementation of the slide show animation effect of the plugin . A cross-site...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the CrossSlide jQuery crossslide-jquery-plugin-for-wordpress plugin 2.0.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings or conduct cross-site scripting XSS...

PT-2015-5596

Name of the Vulnerable Software and Affected Versions crossslide-jquery-plugin-for-wordpress version 2.0.5 Description The issue allows remote attackers to hijack the authentication of administrators for requests, potentially leading to changes in plugin settings or cross-site scripting XSS...

CVE-2015-2039: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings or 2 conduct cross-site scripting XSS attacks via the acobottok...

PT-2015-5560

Name of the Vulnerable Software and Affected Versions Acobot Live Chat & Contact Form plugin version 2.0 Description The issue allows remote attackers to hijack the authentication of administrators for requests, enabling them to change plugin settings or conduct cross-site scripting XSS attacks...

Cross site scripting

Cross-site scripting XSS vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to wp-admin/options-general.php...

CVE-2015-1879: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to wp-admin/options-general.php...

PT-2015-5482

Name of the Vulnerable Software and Affected Versions Google Doc Embedder plugin versions prior to 2.5.19 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to...

Hackers Can Remotely Install Malware Apps to Your Android Device

Security researchers have warned of a pair of vulnerabilities in the Google Play Store that could allow cyber crooks to install and launch malicious applications remotely on Android devices. Tod Beardsley, technical lead for the Metasploit Framework at Rapid7 warns that an X-Frame-Options XFO...

Google Play Bug Can Allow Code Execution

Using a combination of vulnerabilities in the Google Play store and the Android stock browser, attackers can install malicious apps remotely on some Android devices. The attack is the result of a failure on the part of Google’s Play Store Web application to completely enforce the X-Frame-Options...

WordPress Plugin Google Doc Embedder 'options-general.php' HTML Injection Vulnerability

WordPress is a use of PHP language development blog platform, users can support PHP and MySQL database server set up their own weblog. An HTML injection vulnerability in the WordPress plugin Google Doc Embedder 'options-general.php' allows attackers to run supplied HTML and script code or steal...